Security
Magento 2 Patch Installer: Composer Patches Checked Against Disk
A Composer plugin that applies Magento 2 and Adobe Commerce patches, re-checks them against the files on disk on every Composer run, and fails the build when one is missing.
Magento 2 & Adobe Commerce
Production-tested guides, tools, and insights from 8+ years of building, securing, and scaling Magento 2 stores in production.
Magento 2 (now Adobe Commerce) remains one of the most powerful and flexible ecommerce platforms available - but it demands deep operational knowledge to run well. From navigating Adobe's patching strategy to configuring Varnish correctly, from defending against real-world attacks to building reliable deployment pipelines, there's a lot that separates a Magento store that works from one that works well.
This resource hub brings together everything I've written about Magento across blog posts, technical documentation, and open-source projects. Whether you're a Magento developer looking for debugging tips, a DevOps engineer building CI/CD pipelines, or a technical lead evaluating your store's security posture โ you'll find practical, production-tested content here.
Every guide is based on 8+ years of hands-on experience operating Magento stores in production for UK agencies and merchants. I've responded to active security incidents, analysed real malware samples, reported vulnerabilities to Adobe, and built CI/CD tooling used across multiple teams โ not theoretical knowledge.
Magento Security
CVE response guides, malware analysis, security hardening, and DevSecOps practices for Magento 2 stores.
28 articles & guidesMagento DevOps
CI/CD pipelines, deployment automation, infrastructure as code, and operational best practices.
39 articles & guidesMagento Performance
Varnish caching, frontend optimisation, build tuning, and performance monitoring for production stores.
9 articles & guidesMagento AI
Practical AI-assisted development for Magento 2 โ what works, what needs oversight, and how to do it safely.
1 articles & guidesLatest Magento Articles
Recent blog posts covering Magento development, security, DevOps, and more.
Magento 2 E2E Testing: A Playwright Suite You Configure, Not Fork
An open source Playwright end to end testing suite for Magento 2.4.7 to 2.4.9 and Mage-OS, with Luma and Hyvรค supported out of the box, adapted to a store through five JSON config files instead of a per-client fork.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart โ the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146) โ the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Documentation & Guides
In-depth technical docs and step-by-step guides for Magento developers and operators.
Getting Started with Magento
Setup guides and essential configuration for new Magento projects
Magento Development
App/code structure, debugging, and RequireJS guides
Magento Operations
Updates, patching, media management, and SCD optimisation
Magento Security
CVE response guides and pre-production security
Magento Cloud & Commerce
Adobe Commerce Cloud configuration and store codes
Magento Debugging
Database schema comparison and troubleshooting tools
Open-Source Projects & Tools
Magento-related tools, modules, and infrastructure projects.
Featured CI & testing
Magento 2 & Mage-OS Compatibility Matrix: magento.works
Magento 2 and Mage-OS compatibility matrix from 4,057 real Docker installs: which PHP, MySQL, MariaDB, OpenSearch and Redis versions each release runs on.
Security
Magento 2 Isolated Security Patches Through Composer
A Composer meta-package and installer that apply Adobe's isolated and emergency Magento 2 security patches and fail the build when one goes missing.
CI & testing
Magento 2 GitHub Actions: Reusable CI Workflows for Modules
Reusable GitHub Actions workflows for Magento 2 and Mage-OS modules: Composer validation, PHP lint, PHPCS, PHPStan and PHPUnit across a shared list of supported releases.
Featured CI & testing
Magento CI Docker Images: Pre-Installed Magento and Mage-OS
Signed Docker images with Magento 2.4.2 to 2.4.9 and Mage-OS pre-installed across PHP 7.4 to 8.5, for fast Magento module and project CI pipelines.
Security
Patch Magento 2 at Scale: Ansible and Composer Examples
Two ways to roll a Magento 2 security patch across many stores: an Ansible live-patching playbook and a version-constrained Composer patch package.
Magento 2 development and platform engineering
Iโve been working with Magento for 8+ years, based in Cardiff, Wales. Focusing on performance, security, and scalability across UK agencies and merchants. Happy to connect with other developers and engineers.