Security
Magento 2 Patch Installer: Composer Patches Checked Against Disk
A Composer plugin that applies Magento 2 and Adobe Commerce patches, re-checks them against the files on disk on every Composer run, and fails the build when one is missing.
Magento 2 & Adobe Commerce
Production-tested guides, tools, and insights from 9+ years of building, securing, and scaling Magento 2 stores in production.
Running Magento 2 and Adobe Commerce well takes a lot of operational knowledge: Adobe's patching cycle, Varnish, real-world attacks and reliable deploys. This hub collects everything I've written about it, across blog posts, docs and open-source projects.
It all comes from 9+ years running Magento stores for UK agencies and merchants. I've responded to live security incidents, taken apart real malware samples, reported vulnerabilities to Adobe and built CI tooling used across several teams.
Magento Security
CVE response guides, malware analysis, security hardening, and DevSecOps practices for Magento 2 stores.
28 articles & guidesMagento DevOps
CI/CD pipelines, deployment automation, infrastructure as code, and operational best practices.
37 articles & guidesMagento Performance
Varnish caching, frontend optimisation, build tuning, and performance monitoring for production stores.
7 articles & guidesMagento AI
Practical AI-assisted development for Magento 2 — what works, what needs oversight, and how to do it safely.
1 articles & guidesLatest Magento Articles
Recent blog posts covering Magento development, security, DevOps, and more.
Magento 2 E2E Testing: A Playwright Suite You Configure, Not Fork
An open source Playwright end to end testing suite for Magento 2.4.7 to 2.4.9 and Mage-OS, with Luma and Hyvä supported out of the box, adapted to a store through five JSON config files instead of a per-client fork.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146), the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Documentation & Guides
In-depth technical docs and step-by-step guides for Magento developers and operators.
Getting Started with Magento
Setup guides and essential configuration for new Magento projects
Magento Development
App/code structure, debugging, and RequireJS guides
Magento Operations
Updates, patching, media management, and SCD optimisation
Magento Security
CVE response guides and pre-production security
Magento Cloud & Commerce
Adobe Commerce Cloud configuration and store codes
Magento Debugging
Database schema comparison and troubleshooting tools
Open-Source Projects & Tools
Magento-related tools, modules, and infrastructure projects.
Featured CI & testing
Magento 2 & Mage-OS Compatibility Matrix: magento.works
Magento 2 and Mage-OS compatibility matrix from 4,057 real Docker installs: which PHP, MySQL, MariaDB, OpenSearch and Redis versions each release runs on.
Security
Magento 2 Isolated Security Patches Through Composer
A Composer meta-package and installer that apply Adobe's isolated and emergency Magento 2 security patches and fail the build when one goes missing.
CI & testing
Magento 2 GitHub Actions: Reusable CI Workflows for Modules
Reusable GitHub Actions workflows for Magento 2 and Mage-OS modules: Composer validation, PHP lint, PHPCS, PHPStan and PHPUnit across a shared list of supported releases.
Featured CI & testing
Magento CI Docker Images: Pre-Installed Magento and Mage-OS
Signed Docker images with Magento 2.4.2 to 2.4.9 and Mage-OS pre-installed across PHP 7.4 to 8.5, for fast Magento module and project CI pipelines.
Security
Patch Magento 2 at Scale: Ansible and Composer Examples
Two ways to roll a Magento 2 security patch across many stores: an Ansible live-patching playbook and a version-constrained Composer patch package.
Magento 2 development and platform engineering
I’ve been working with Magento for 9+ years, based in Cardiff, Wales. Focusing on performance, security, and scalability across UK agencies and merchants. Happy to connect with other developers and engineers.