One package carries every Adobe isolated and emergency patch your version needs. Require it once, and CI tells you the day a store falls behind.
| APSB26-146 | StyleSmuggler, CVE-2026-75650 | applied |
| APSB26-92 | August isolated patch | applied |
| APSB26-73 | CVE-2026-31431 | applied |
| Session Reaper | CVE-2025-54236 | applied |
| CosmicSting | CVE-2024-34102 | applied |
Example output from a live Magento 2.4.7-p10 store. Every target is read from the files on disk, not from a record of earlier runs.
Composer will not run a plugin it has not been told to trust, and the installer will not read patches from a package nobody has named. Run both lines before the install.
composer config --no-plugins allow-plugins.samjuk/magento-patch-installer true
composer config --json extra.magento-patches.trust '["samjuk/*"]'It resolves the patches that apply to your version and applies them after the install completes. Miss the trust config and the run stops and says so rather than half-patching.
composer require samjuk/m2-meta-security-patchesAdd verify as its own pipeline step. A plugin Composer has not been told to trust is skipped silently, and the build still exits 0 having applied nothing, so check the exit code explicitly.
composer magento-patches:verifyA composer reinstall of magento2-base puts an unpatched root file back, and a tool trusting its applied-patches record still reports green. Every target here is re-checked against disk on each Composer run, so a reverted patch gets re-applied.
composer magento-patches:status -v lib/web/underscore.js applied app/code/Magento/... applied
If a module replaces a package that one patched file belongs to, other tools drop the entire patch without saying so. Here patches split per file: the uncoverable target is named and skipped, the rest still applies.
Any installed dependency being free to declare a patch against your code is a supply chain problem, not a feature. Anything not named in the trust config is ignored rather than honoured.
composer config --json \ extra.magento-patches.trust '["samjuk/*"]'
Give verify a step of its own. A plugin Composer has not been told to trust is skipped silently, and the build still exits 0 having applied nothing.
composer magento-patches:verify exit 1 # one or more targets missing
If your store runs vaimo or cweagans for its own patches, they keep working. When another tool patches the same file in a way that moves the hunks, this reports a CONFLICT rather than applying over it.
Community Edition patches install cleanly on Adobe Commerce and report everything green, because both editions share most packages. The EE-specific code Adobe patches separately goes untouched. The package declares a Composer conflict with magento/product-enterprise-edition and magento/product-b2b-edition so the install is refused rather than quietly partial. Mage-OS is supported, which is why it is a conflict rather than a requirement on magento/product-community-edition.
| Target | Result |
|---|---|
| Magento and Mage-OS images in CI, 2.4.2 to 2.4.9 | 82 images |
| Live upgrade from vaimo, Magento 2.4.7-p10 | 59 of 59 targets applied |
| Clean install, Magento 2.4.9 with Hyvä | 57 of 57 targets applied |
| Adobe Commerce refusal | regression test, no licensed image to prove it at run time |
From 2026.09.11-beta2 it applies patches through samjuk/magento-patch-installer rather than vaimo/composer-patches. You do not remove vaimo yourself. It is a dependency of the meta-package, so the update removes it, and it reverts its own patches on the way out before the new installer re-applies them from scratch.
The release carrying it is tagged a pre-release on purpose. A store on a stable constraint such as >=2026.02.01 still resolves to 2026.09.08 because Composer filters the beta out on stability. Opt in explicitly with composer require samjuk/m2-meta-security-patches:2026.09.11-beta2@beta.
The update stops partway and says so. Add them, run composer install, and it recovers fully. Failing loudly beats half-patching in a security tool.
The isolated and emergency patches Adobe has shipped for your version, including CosmicSting (CVE-2024-34102), Session Reaper (CVE-2025-54236) and StyleSmuggler (CVE-2026-75650), and every monthly isolated patch since the cadence changed.
No. It covers the isolated and emergency patches Adobe ships between releases. Staying on a supported Magento version is still your job.