Magento News

Do you think Sansec could help here? Adobe really needs to take security issues more seriously and invest more resources into addressing them proactively. Every RCE can result in significant financial and reputational damage, which can easily outweigh the cost of fixing these vulnerabilities properly before they are exploited. Waiting until after an incident to act is much more expensive. submitted by /u/FastAndSlooow [link] [comments]

Modernizing a global B2B commerce platform built on Magento presents a unique set of technical challenges. From migration risk and legacy technical debt to slow site speed and complex integrations, enterprise merchants face hurdles that directly impact scalability and operational efficiency. This case study dives into a real-world Magento migration and optimization project, focusing on the architecture, performance tuning, and post-migration growth strategies that helped an enterprise B2B merchant transform their Adobe Commerce platform. The Problem: Complex B2B Migration and Performance Bott…

submitted by /u/php4u [link] [comments]

A Magento store can return HTTP 200 for every page and still be quietly broken. Uptime monitoring is good at answering "is the website reachable?" It is much worse at answering "is Magento actually doing the work it is supposed to do?" Here are three checks I use when diagnosing a store. 1. Is cron actually running? Magento relies heavily on cron for scheduled work, including indexing, price rules, newsletters, emails, staging-related jobs and many third-party modules. The first place I look is: SELECT status, COUNT(*) AS jobs, MAX(finished_at) AS last_finished FROM cron_schedule WHERE schedu…

RabbitMQ is the invisible engine behind Magento 2's asynchronous work: bulk REST operations, async endpoints, order emails, product alerts, inventory reservation cleanup and B2B quote and shared-catalog updates all travel through message queues. The storefront can be perfectly fast while the queues silently back up — orders confirmed, but emails arriving an hour late, bulk operations stuck on "processing", and inventory_reservation rows growing because the cleanup consumer never caught up. This guide is about the layer most performance audits skip: the broker and the consumers that drain it.…

submitted by /u/Boring-Ad-6591 [link] [comments]

Today, Adobe released the regular Isolated Security Patch, next to the patch of yesterday for StyleSmuggler. Mageinfo.online detects the presence of the Isolated Security Patch of September, since an hour ago. For details about the latest patch Adobe released, and why you should patch asap: https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-44020 submitted by /u/Boring-Ad-6591 [link] [comments]

​We recently audited a Magento 2 production store where page response times were sitting around 14 seconds. The server load average was sitting at 5.7 and MySQL CPU was pegged at 70%, but standard tricks like Varnish, DB indexing, or CDN tweaks weren't making a dent. ​ Instead of an architecture or database issue, the culprit was three silent process killers running in the background. ​The Initial Diagnostics (strace & logs) ​PHP-FPM web workers were hanging for over 23 minutes on standard web requests (not cron jobs). ​system.log had hit 8.6 million lines; debug.log was bloated to 8GB. ​Runn…

We're upgrading a staging environment to Magento 2.4.8-p5. Looking at app/etc/di.xml, the SqlVersionProvider supported-version patterns now look like this: So here in the app/etc/di.xml they have mentioned mariadb 10.2-10.6, but on the official documentation System requirements, they mentioned MariaDB 11.4,11.8. On my staging site environment mariadb 10.5 is supported, so can I go forward with that? Or should we really have to upgrade it to 11.4? please help me here guys. Thanks in advance.

Cron jobs and queue consumers are the background engine of a Magento 2 store — and the most common place where memory problems hide. A web request lives for a second and dies, taking its garbage with it. A queue consumer or a heavy cron job can run for hours, and every leak it accumulates stays in the process until it crashes. The typical story: the consumer worked fine on Monday. By Wednesday it has processed 40,000 messages, its RSS has climbed from 120 MB to 900 MB, and at 2 AM it slams into memory_limit and dies. Messages pile up, the email backlog grows, and the only clue in the logs is…

Released: 2026-09-08 Upstream: Magento Open Source 2.4.9 Mage-OS 3.5.0 is an emergency security release. It ports Adobe's VULN-39341 hotfix for StyleSmuggler (CVE-2026-75650, CVSS 10.0, APSB26-146) — an unauthenticated remote code execution flaw that has been exploited in the wild since 4 September 2026 — along with a layer of defense-in-depth hardening around the same attack surface, Adobe's September isolated patch 249-2026-09-001-CE (APSB26-138), and four bug fixes. Every Mage-OS 3.x installation should upgrade immediately. composer require mage-os/product-community-edition 3.5.0 --no-upda…

Originally published at HOL If you applied Adobe's StyleSmuggler hotfix yesterday and stopped there, Adobe Commerce and Magento Open Source still carry a separate September patch train. APSB26-138 (Priority 2, published September 8, 2026) closes eight Critical issues, including unauthenticated authorization bypasses and stored XSS that can escalate privileges. Adobe states it is not aware of exploitation for these issues. That is not the same as "the StyleSmuggler hotfix covered it." The operator trap is explicit in Adobe's release notes: the APSB26-146 hotfix for CVE-2026-75650 is not bundle…

Includes 8 critical CVSS score fixes. submitted by /u/william_o [link] [comments]

A slow login is one of the most damaging performance problems a store can have. Unlike a slow category page, which costs you a view, a slow login sits directly between a returning customer and their wallet. Every extra second on the authentication path quietly raises cart abandonment and pushes people toward guest checkout or a competitor. The frustration is that login slowness rarely shows up in your standard page-speed metrics. A login POST is a form submission, not a render — so Core Web Vitals tells you nothing. You have to measure the request itself and understand the work Magento does b…

submitted by /u/Boring-Ad-6591 [link] [comments]

CVSS score of 10.0, so install directly: https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146 Want to check if your shop is up to date with the other patches available, check https://mageinfo.online submitted by /u/Boring-Ad-6591 [link] [comments]

Cybercriminals are exploiting a zero-day vulnerability in Adobe Commerce and Magento, identified as "StyleSmuggler," to deploy a sophisticated Linux backdoor on e-commerce servers. The attack leverages vulnerabilities in the way the platform handles CSS and layout templates, allowing attackers to bypass security measures and gain deep access to the underlying server architecture. Once the backdoor is established, threat actors can maintain persistent access, execute arbitrary commands, and potentially intercept sensitive customer information or payment data. Security experts recommend that Ma…

submitted by /u/tb9295 [link] [comments]

Anyone tried upgrading from 2.4.7p4 to 2.4.9 and had success doing so? Or should I just do a fresh 2.4.9 install and import everything over with Products, Categories, Order, Customers, etc. Looking for the fastest and easiest process. If importing everything how accurate and effective would it be? submitted by /u/tb9295 [link] [comments]

Originally published at HOL If you run Adobe Commerce or Magento Open Source with GraphQL reachable, an unauthenticated caller can smuggle PHP into Magento's template engine through styles properties and get that code executed when Magento renders its own "Payment Transaction Failed Reminder" email. Adobe published APSB26-146 today (Priority 1) for CVE-2026-75650, scored CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C), and states the bug is already exploited in the wild. The fix is the VULN-39341 composer hotfix, not a full minor release. Sansec tracked the same chain as StyleSmuggler with confirmed expl…