Security
Magento 2 Patch Installer: Composer Patches Checked Against Disk
A Composer plugin that applies Magento 2 and Adobe Commerce patches, re-checks them against the files on disk on every Composer run, and fails the build when one is missing.
Security
Write-ups and mitigations for the Magento and Linux vulnerabilities I respond to, usually published while the incident is live.
When a Magento or Linux vulnerability lands and I have something useful to add, such as a mitigation nobody has published yet or a check that works across a fleet, I write it up: a post for what happened and a docs page with the copy-pasteable checks and fixes. The docs page is the one that stays up to date.
Most of the work happens before anything lands. Pull requests have to pass Sansec eComscan, Magento-specific Semgrep rules and composer audit before they can merge, builds and deploys run on hardened Docker images, and Adobe's isolated patches go out through Composer rather than by hand.
Found something in one of my projects or sites? The security policy covers how to report it, with my PGP key and response times.
Incident write-ups
Vulnerability responses, malware teardowns and patch notes.
PHP2SHELL (CVE-2026-109618): Patching a Small PHP Estate on Release Day
How we prepared for and patched PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) across native, Docker and Kubernetes PHP, from a Slack leak to the last site back.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
StyleSmuggler (CVE-2026-75650): Emergency Magento 2 Mitigation & Recovery
How to detect, contain and recover from StyleSmuggler (CVE-2026-75650 / VULN-39341, APSB26-146), the actively exploited Magento and Adobe Commerce zero-day RCE.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Mitigation guides
Copy-pasteable checks and fixes, kept up to date after the write-up.
StyleSmuggler (CVE-2026-75650)
Emergency mitigation and recovery for the Magento zero-day
CopyFail (CVE-2026-31431)
Disable algif_aead to block the Linux kernel privilege escalation
DirtyFrag & Copy Fail 2
Block esp4, esp6 and rxrpc to stop the follow-up kernel bugs
PolyShell
Malicious uploads through product custom options
Session Reaper (CVE-2025-54236)
Patch the unauthenticated RCE and check for backdoors
CosmicSting (CVE-2024-34102)
Check, patch and rotate keys after the Magento XXE
PHP October 2026 security fix check
Behavioural check for CVE-2026-109618 and CVE-2026-109619
Security tools
Open-source scanners, validators and patch tooling.
Security
Magento 2 Isolated Security Patches Through Composer
A Composer meta-package and installer that apply Adobe's isolated and emergency Magento 2 security patches and fail the build when one goes missing.
Security
Patch Magento 2 at Scale: Ansible and Composer Examples
Two ways to roll a Magento 2 security patch across many stores: an Ansible live-patching playbook and a version-constrained Composer patch package.
Security
CosmicSting Validator: Check Magento for CVE-2024-34102
A free online checker and bulk CLI tools that test Magento 2 stores for CosmicSting (CVE-2024-34102), built on a PHP port of Chocapikk's public proof of concept.
Security
Ansible Role for Sansec eComscan Malware Scans
A CI-tested Ansible Galaxy role, samjuk.ecomscan, that runs Sansec eComscan across a fleet of hosts once or on a cron schedule, with email and Slack reports.
SamJUK-EWS scanner
What my non-destructive vulnerability scanner checks for
Responsible disclosures
A selection of issues I have reported to vendors and store owners. Kept high-level on purpose, and every one was resolved with the affected party.
CosmicSting Mass Vulnerability Scanning
Multiple Retailers · Magento Stores
Conducted automated scanning and responsible disclosure to hundreds of Magento stores vulnerable to the critical CosmicSting XXE vulnerability. Ranging from small businesses to large enterprises, helping merchants mitigate risks before active exploitation.
Read the write-up →Magento 2 Admin Backdoor
Major Power Tools Franchise · Magento Store
Identified a publicly accessible PHP backdoor script providing unauthorized administrative access to a Magento store as well as a SQL console to the database.
Magento 2 Sensitive Information Disclosure
Tattoo Retailer · Magento Store
Identified a vulnerability that allowed unauthorized access to sensitive files, ranging from payment log files, to configuration files containing database credentials, package auth keys and API keys potentially leading to further exploitation.
Magento 2 Sensitive Information Disclosure
Photonics Manufacturer · Magento Store
Identified a vulnerability that allowed unauthorized access to sensitive files, ranging from payment log files, to configuration files containing database credentials, package auth keys and API keys potentially leading to further exploitation.
Collection of Stored XSS Vulnerabilities
Mirasvit · Magento Extensions
Discovered and reported collection of stored XSS vulnerabilities across a range of Mirasvit extensions, to prevent malicious scripts being injected both into the admin and frontend interfaces.
SQL Injection in Pay360 Order Export
Pay360 · Magento 1 Extension
Identified and reported an SQL injection vulnerability in the order export functionality of a Pay360 Magento 1 extension, to prevent potential manipulation of database queries and access to sensitive information.
Product names and logos on this page are trademarks of their respective owners.
Reporting a vulnerability to me
Found something in one of my sites or projects? The policy covers scope, response times, safe harbour and my PGP key.
Security research and incident response
I report vulnerabilities to Adobe and extension vendors, and write up live Magento incidents as they happen. Happy to compare notes with other people doing the same.