PHP2SHELL (CVE-2026-109618): Patching a Small PHP Estate on Release Day
How we prepared for and patched PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) across native, Docker and Kubernetes PHP, from a Slack leak to the last site back.
Author
Sam James
Engineer specialising in Magento 2, Adobe Commerce, DevOps, and e-commerce security
50 Magento & Engineering Articles
102 Technical Documentation Guides
10+ years Web Engineering Experience
Sam James's Areas of Expertise
Sam James writes about a range of topics drawn from professional experience in Magento, DevOps, and e-commerce engineering.
Recent Articles (50)
Magento 2 E2E Testing: A Playwright Suite You Configure, Not Fork
An open source Playwright end to end testing suite for Magento 2.4.7 to 2.4.9 and Mage-OS, with Luma and Hyvä supported out of the box, adapted to a store through five JSON config files instead of a per-client fork.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146), the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
Recent Documentation (102)
DevOps & Infrastructure
Production DevOps documentation: CI/CD pipelines, Ansible/Terraform automation, monitoring strategies, and infrastructure deployment workflows.
CI/CD Pipelines
CI/CD pipeline guides for GitHub Actions and Bitbucket: workflow automation, artifact management, environment cleanup, and troubleshooting.
Bitbucket Pipelines
Bitbucket Pipelines CI/CD guides: Renovate dependency automation, pipeline configuration, and third-party integrations for DevOps workflows.
Renovate Mend - Bitbucket
Configure Renovate Mend for automatic dependency updates in Bitbucket. Step-by-step setup guide with marketplace integration and config examples.
GitHub Actions
Production-tested GitHub Actions workflows: SSH config, artifact cleanup, environment management, Dependabot automation, bulk actions state management, and troubleshooting guides.
GitHub Artifact Cleanup
Automate GitHub Actions artifact cleanup with CLI commands. Bulk delete workflows, manage storage, and optimize repository artifacts efficiently.
Stack Exchange Contributions
60+ answers 1900+ reputation
Active contributor on Magento Stack Exchange — answers cover development, performance, security, and troubleshooting.
-
File type .svg Error in image upload Magento 2.3.1
Explained that they are disabled in the first place for security reasons, and provided a few ways to re-enable them if needed. View on StackExchange →
-
Problems with friendsofphp/php-cs-fixer and php7.3
PHPCS fixer is not supported above PHP7.2, explained options on how to install without dev dependencies, remove the package or downgrade PHP to a supported version. View on StackExchange →
-
CollectRates in custom carrier is not called when weight is over zero
Explained that the issue likely stemmed from not setting the max package weight correctly, which in turn would set the max package weight to zero. View on StackExchange →
-
How to use systemd timer to replace OS system cron for Magento?
Provided an example of a systemd timer and service file to run Magento cron jobs, along with instructions on how to enable and start the timer. View on StackExchange →
-
Magento 2.3 secure your site back and front
Provided an non exhaustive list of steps to help secure a Magento 2.3 site, including using WAFs, file/IP restrictions, Scanning Tools, Integrity monitoring and more. View on StackExchange →