Security
Magento 2 Patch Installer: Composer Patches Checked Against Disk
A Composer plugin that applies Magento 2 and Adobe Commerce patches, re-checks them against the files on disk on every Composer run, and fails the build when one is missing.
Magento 2 Security
CVE response guides, real-world malware analysis, and battle-tested security practices for Magento 2 and Adobe Commerce stores.
A Magento store handles card data, and Adobe ships security patches on a schedule plus isolated fixes between them (every Magento security patch, and which you need). These guides cover CVE response (CosmicSting, Session Reaper), malware recovered from compromised stores and DevSecOps checks that run before deploy.
I have reported vulnerabilities to Adobe, Amasty, Mirasvit and Pay360. Incident write-ups and disclosures beyond Magento are on the security hub.
Security Articles & Analysis
CVE response guides, malware teardowns, and practical security hardening for Magento 2.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146), the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Copy Fail 2 / DirtyFrag (CVE-2026-31431): Container Escape & LPE Follow-Up
The sequel to CopyFail: DirtyFrag extends the CVE-2026-31431 exploit chain to container escape. Covers the new attack surface, detection, and mitigations beyond the algif_aead workaround.
CopyFail (CVE-2026-31431): Linux Kernel LPE — Detection, Mitigation & Distro Patch Status
CVE-2026-31431 is a Linux kernel local privilege escalation via algif_aead. Covers exploit mechanics, detection, the algif_aead mitigation, and patch status across Ubuntu, Fedora, Debian, RHEL, and more.
Magento 2 Polyshell RCE: Technical Breakdown, PoC & Patch Guide
Deep dive into the Magento 2 Polyshell remote code execution vulnerability — how it works, how to test if you're affected, and how to apply the patch.
Adobe's Isolated Patch Strategy: A Community Response
Adobe's new monthly isolated patch approach for Magento creates maintenance burden. Here's how a community meta-package can help restore sanity to security patching.
Strengthening Magento 2 Security in CI/CD Pipelines with Sansec Ecomscan
Learn how to integrate Sansec Ecomscan into Magento 2 CI/CD pipelines to detect malware, enforce security patches, and secure build artifacts. Step-by-step guides for GitHub Actions and Bitbucket Pipelines included.
Check if your Magento site is safe from Session Reaper (CVE-2025-54236)
How to guide on checking if your Magento 2 store is safe from the Session Reaper (CVE-2025-54236) exploit. And guidance on how to patch and secure your site if it is not.
How to efficiently patch Magento 2 deployments at scale
Approaches to simply deploying patches across a large inventory of Magento 2 deployments
The Magento 2 Setup Endpoint is leaking your Magento Version
Have you explicitly disable the Magento 2 setup route in your web server configuration? The vast majority of sites scanned are showing this route as leaking your full Magento Version.
Magento Trojan Orders (CVE-2022-24086) - addAfterFilterCallback
Magento 2 Trojan Orders (CVE-2022-24086) are back, lets talk about how to patch so we are safe. And other identifiers aside from addAfterFilterCallback
Simple 2 line fix for Polyfill.io Malware in Magento 2
A quick and easy two line fix configuration fix for the Polyfill.io Magento 2 Malware
CosmicSting (CVE-2024-34102): Check and Patch Your Magento Store
Free validator tool to check if your Magento 2 store is vulnerable to CosmicSting (CVE-2024-34102) — 6,500+ stores tested, 2,300+ found vulnerable. Step-by-step patching guide included.
Anonymizing Magento 2 Databases with Warden
A simple guide for anonymizing Magento 2 databases in Warden to either pass off to other developers or move forward into staging/ephemeral environments
Analyzing a real Magento 2 Stripe CC Scraper Malware Sample
Analyzing Magento 2 Malware used to Scrape Stripe credit card credentials. Injected via the shipping policy in the core_config_data DB table.
Magento 2 Malware Scanning with Sansec Ecomscan - CLI, Automation & Bulk Scans
How to setup and configure Malware scanning with Sansec Ecomscan for a single Magento 2 site or in bulk with Ansible
Magento 2 Malware Analysis
PHP2SHELL (CVE-2026-109618): Patching a Small PHP Estate on Release Day
How we prepared for and patched PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) across native, Docker and Kubernetes PHP, from a Slack leak to the last site back.
Is 100% uptime a bad goal?
Should you aim for 100% uptime across your servers? Or instead target fluid infrastructure where short lived nodes can spawn and die as required?
Blocking TOR exit routes
How do we go about blocking TOR / Onion traffic to our site?
Security Documentation
Step-by-step guides for specific vulnerabilities, server hardening, and protective configuration.
Magento 2 Security Patches
Every APSB bulletin and isolated patch from 2025 to 2026, and which ones your store needs
CosmicSting (CVE-2024-34102)
Detection, validation, and remediation guide. Free validator tool available at cosmicsting.samdjames.uk.
Session Reaper (CVE-2025-54236)
Impact analysis and patching steps
Pre-Production: Robots No Index
Prevent staging environments from leaking to search engines
Nginx Rate Limiting
Protect Magento storefronts from brute-force and DDoS attacks
Replacing Polyfill.io with Nginx
Mitigate the compromised polyfill.io supply chain attack
Fail2Ban Configuration
Automated IP banning for repeated attack patterns
Security Tools & Projects
Open-source tools for vulnerability scanning, malware detection, and security automation.
Security
Magento 2 Isolated Security Patches Through Composer
A Composer meta-package and installer that apply Adobe's isolated and emergency Magento 2 security patches and fail the build when one goes missing.
Featured CI & testing
Magento CI Docker Images: Pre-Installed Magento and Mage-OS
Signed Docker images with Magento 2.4.2 to 2.4.9 and Mage-OS pre-installed across PHP 7.4 to 8.5, for fast Magento module and project CI pipelines.
Security
Patch Magento 2 at Scale: Ansible and Composer Examples
Two ways to roll a Magento 2 security patch across many stores: an Ansible live-patching playbook and a version-constrained Composer patch package.
Security
CosmicSting Validator: Check Magento for CVE-2024-34102
A free online checker and bulk CLI tools that test Magento 2 stores for CosmicSting (CVE-2024-34102), built on a PHP port of Chocapikk's public proof of concept.
Security
Ansible Role for Sansec eComscan Malware Scans
A CI-tested Ansible Galaxy role, samjuk.ecomscan, that runs Sansec eComscan across a fleet of hosts once or on a cron schedule, with email and Slack reports.
Featured Open source
Magento 2 Open Source Contributions: Core, Mage-OS, Warden
29 merged pull requests into Magento 2, Mage-OS, Warden and other open source since 2020, including three in Magento core with measured di:compile gains.
Frequently Asked Questions
How do I check if my Magento store is vulnerable to CosmicSting?
Run the free CosmicSting Validator at cosmicsting.samdjames.uk, which has scanned over 6,500 stores and found more than 2,300 vulnerable. To check by hand, follow the CVE-2024-34102 guide below. Adobe fixed CosmicSting in APSB24-40 in June 2024, so any 2.4.7 or earlier store without that release or Adobe's isolated patch is exposed.
What are the most common Magento security threats?
Card skimmers are the most common: injected JavaScript that copies payment details at checkout. After that come unpatched core vulnerabilities such as CosmicSting and Session Reaper, vulnerable third-party extensions, and supply chain attacks like the Polyfill.io takeover. Patching quickly, scanning for malware and keeping extensions to a minimum covers most of it.
How often should I patch my Magento 2 store?
As soon as a security release or isolated patch lands, not on a quarterly schedule. In 2026 Adobe shipped isolated patches between its scheduled releases (APSB26-73 in July, APSB26-92 in August), and critical vulnerabilities can be exploited within 24 hours of disclosure. Rolling patches out through Composer and Ansible is what makes same-day patching possible across many stores.
How do I scan my Magento store for malware?
I use Sansec eComscan, both on the servers and as a CI check on every pull request, so an infected file is caught before it is deployed. On the servers, run it on a schedule across every store. Also check payment-related JavaScript and the database, where skimmers are often stored.
Magento security & infrastructure
I’ve worked on active security incidents, analysed malware samples, and reported vulnerabilities to Adobe and major extension vendors. Based in the UK, I’m happy to share insights or discuss security best practices with fellow developers.