Latest Post
PHP2SHELL (CVE-2026-109618): Patching a Small PHP Estate on Release Day
How we prepared for and patched PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) across native, Docker and Kubernetes PHP, from a Slack leak to the last site back.
Writing
Sam James's Articles
Discover expert insights from Sam James on Security, Magento 2, DevOps, AI Development, Infrastructure. Stay updated with the latest trends, practical guides, and in-depth analysis in Magento & Ecommerce.
All posts Security(23) Magento 2(39) DevOps(24) AI Development(1) Infrastructure(2) Performance(3) Ramblings(2)
Magento 2 E2E Testing: A Playwright Suite You Configure, Not Fork
An open source Playwright end to end testing suite for Magento 2.4.7 to 2.4.9 and Mage-OS, with Luma and Hyvä supported out of the box, adapted to a store through five JSON config files instead of a per-client fork.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146), the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Operational Maturity Before AI Velocity: What Your Magento Team Needs First
AI is a force multiplier for Magento development — but it multiplies whatever processes you already have. Here's the operational stack your team needs before leaning heavily into AI-generated output.
Copy Fail 2 / DirtyFrag (CVE-2026-31431): Container Escape & LPE Follow-Up
The sequel to CopyFail: DirtyFrag extends the CVE-2026-31431 exploit chain to container escape. Covers the new attack surface, detection, and mitigations beyond the algif_aead workaround.
CopyFail (CVE-2026-31431): Linux Kernel LPE — Detection, Mitigation & Distro Patch Status
CVE-2026-31431 is a Linux kernel local privilege escalation via algif_aead. Covers exploit mechanics, detection, the algif_aead mitigation, and patch status across Ubuntu, Fedora, Debian, RHEL, and more.