Latest Post
PHP2SHELL (CVE-2026-109618): Patching a Small PHP Estate on Release Day
How we prepared for and patched PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) across native, Docker and Kubernetes PHP, from a Slack leak to the last site back.
Writing
Making Magento Do Things Adobe Never Intended
DevOps, SRE, Platform Engineering, and a Side of Questionable Architectural Choices
All posts Security(23) Magento 2(39) DevOps(24) AI Development(1) Infrastructure(2) Performance(3) Ramblings(2)
Magento 2 E2E Testing: A Playwright Suite You Configure, Not Fork
An open source Playwright end to end testing suite for Magento 2.4.7 to 2.4.9 and Mage-OS, with Luma and Hyvä supported out of the box, adapted to a store through five JSON config files instead of a per-client fork.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146), the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Operational Maturity Before AI Velocity: What Your Magento Team Needs First
AI is a force multiplier for Magento development — but it multiplies whatever processes you already have. Here's the operational stack your team needs before leaning heavily into AI-generated output.
Copy Fail 2 / DirtyFrag (CVE-2026-31431): Container Escape & LPE Follow-Up
The sequel to CopyFail: DirtyFrag extends the CVE-2026-31431 exploit chain to container escape. Covers the new attack surface, detection, and mitigations beyond the algif_aead workaround.
CopyFail (CVE-2026-31431): Linux Kernel LPE — Detection, Mitigation & Distro Patch Status
CVE-2026-31431 is a Linux kernel local privilege escalation via algif_aead. Covers exploit mechanics, detection, the algif_aead mitigation, and patch status across Ubuntu, Fedora, Debian, RHEL, and more.