Running composer update alone may not apply Adobe's fix for CVE-2026-103849, per Sansec. Check that you installed the 2026-oct release (2.4.7-p10, 2.4.8-p5 or the 2.4.9 patch) or Adobe's isolated patch from KB ka-49323, and that the VULN-39341 StyleSmuggler hotfix is still in place, since the two fixes are separate. Mage-OS users should upgrade the mage-os/product-community-edition metapackage to 3.6.0. If you can't patch within hours, put a WAF rule in front of the store and scan for backdoors after patching.