The PHP security team has released fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), that can allow someone with no account and no access to your site to run their own code on the server. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team state that there are no complete mitigations and updating is the only safe choice.

If you're running Magento, patch now, or ask your host to.

Our writeup can be found here: https://prostack.uk/blog/critical-php-security-update-october-2026/ - hope it's useful.

PHP2Shell has been rated 9.2 out of 10. Sansec Shield may not be able to block.

There’s a patch being released at 2PM and attacks are expected to start within 15 minutes.

Enjoy restructuring your day everyone!

https://sansec.io/research/php2shell

I want a platform that helps me manage the WAF whenever new vulnerabilities come out. It should also let me update the server requirements quickly when I need to.

Hello guyz!,
Has Magento work really dried up?

Just a heads up if anyone uses Revolut. In my case the section that shows product in cart page was missing.

I guess their official plugin not exactly built with the highest quality...

Thanks everyone for all the help and suggestions, I am inching my way there.

I have downloaded and install the Patches for my version 2.4.8-p5 for July and August and was able to get them patched. After I was able to run a status check and there are some of the CVE_2026-xxxxx Vulnerability Details/status are showing "NOT_APPLICABLE". Does this mean they are not intalled or not needed and avoided? Most of the them do show "PROTECTED"

How do I know if I am 100% patched for these two (July and August) Patches?

Details as follows:

Here are the status showing the two patches were installed

"applied_patches": [

"248p5-2026-07-001-CE",

"248p5-2026-08-001-CE"

],

"missing_patches": [

"248p5-2026-09-001-CE",

"248p5-2026-10-002-CE",

"248p5-VULN-39341-CE"

],

"unknown_patches": [

"248p5-2026-10-001-CE"

However after appying the August patch I did receive the fowwing warning.

"registry_source": "cache",

"warnings": [

"Failed to forward-apply prerequisite 248p5-2026-07-001-CE when preparing dry-run for 248p5-2026-10-001-CE; result may be inaccurate"

Also after running the Patches I did run Adobe Security Scan and shows Alerts and Notifications -The patches or security updates might be available for your store.

Group: Patch Scan Name: APSB26-73 Status: Alert

I also ran MageInfo Online Scan and also appears to be an issue unless I am reading these results wrong.

One of these versions

• (x) 2.4.8-p5
• (x) 2.4.8-p5-patch-july2026

Not on the latest version (2.4.8-p5-patch-sep2026). Advice: update immediately!

Isolated security patches

• July 2026 — Gallery XSS hardening Unknown
• August 2026 — APSB26-92 bundle Missing
• September 2026 — ka-44020 (IDOR/ACL fixes) Missing
• October 2026 — email template, token and escaping fixes Unknown

As for as Sept and Oct patches, I was not able to run the Sept (APSB26-138) patch successfully as I did the first two. It failed to install for some reason, not sure if there a different way to install than the other two because there are two patches for Sept. Trying to ge this part figured out as well before Octobers which seems to be the issue with two patches

Hey everyone,

I’m a senior Magento 2 developer and Adobe Certified Expert, and I’ve worked on a lot of Magento 2 projects over the years. One thing I kept noticing is how hard it is to find learning material that’s current. A lot of tutorials out there are outdated or skip the “why” behind things.

So I started a free Magento 2 course on YouTube. I’m uploading around 10 videos a day, so the playlist is growing quickly.

Playlist: https://www.youtube.com/playlist?list=PLF9CIkwl81j0

I’d love your input: if there’s a Magento topic that has always confused you drop it in the comments and I’ll add a video on it to the playlist.

Feedback on the existing videos is welcome too, good or bad. I want this to actually be useful.

Hello guys! I added the default hyva theme on M2 and got it running, but I came across this problem, where the view at let's say "abcd.com" doesn't have the same navbar as "abcd.com/home". I am new to Magento, I don't know what to do.

I was in the process on trying to update the July APSB26-73 Patch when I was alerted the newely released 2.4.8-p6 includes the critical security fixes from APSB26-73.

However I cannot verify this any where else online. Has anyone noticed this before I attemp this update

A while back I posted about Lynx, the single-page app storefront we've been building for Magento 2. The first version is now released.

- Runs inside Magento: no separate frontend app or hosting like a PWA

- React or Vue components

- Drag-and-drop builder for every page, not just CMS pages

- One-page fast checkout

- MCP support for building pages with Claude, plus public Claude skills for third-party module compatibility: https://github.com/oocscommerce/claude-skills

- 95+ mobile PageSpeed on the demo

Demo: https://lynx-demo.oocscommerce.com/

Docs: https://docs.oocscommerce.com/lynx/

Free license, no credit card: https://www.oocscommerce.com/lynx-magento.html

Thanks to everyone who gave feedback on the earlier post. Bug reports and questions are very welcome

I am needing to update all the monthly security patch releases they have released since July ASAP.

I have successfully updated my site from 2.4.7 to 2.4.8-p5 on my own and have several other updates in the past, however applying these updates looks a little different to me and I have yet to figure the best and simplest possible way to this.

One of the more important patches I need is for StyleSmuggler as it appears I may have got hit with it. While I know the patch will not clean it, I still need the protection for it along with an alert I received that APSB26-73 (July Patch, I believe) is not installed.

Anyone with east to follow steps to patch all patches available, please suggest.

Hi everyone!

I’d like to share an open-source module for OpenMage / Magento 1 that I recently built for a real-world project and published on GitHub: Modestox_DeltaLog.

To be transparent, I’m not claiming this module is revolutionary or that it’s a commercial-grade product. I built it to solve a practical problem in a live project, while also contributing to my portfolio and growing my open-source presence.

What problem does it solve?

In stores managed by multiple admins or managers, it’s a familiar story: someone changes an order status, a product price, or a customer group, and later there’s no easy way to determine who made the change.

Existing auditing solutions can sometimes be overly complex, generate excessive database writes, or introduce unnecessary overhead whenever an object is saved.

What does the module do?

Modestox_DeltaLog tracks selected data changes, recording:

• Who made the change (admin, customer, Cron, or CLI)
• When it happened
• Source IP address, where available
• What changed, including previous and updated values

Key features

• Performance-focused: Tracking rules are compiled into the OpenMage cache, reducing the need for database lookups on every object save.
• Automated log cleanup: A scheduled Cron job purges outdated logs daily according to a configurable retention period.
• PHP 8.3 compatibility: The codebase uses strict typing throughout.

A note on testing

I’ve tested the module against my own use cases, and it works well for the scenarios it was designed to handle. That said, it hasn’t been extensively tested against every possible edge case, unusual third-party module configuration, or high-load environment.

The module is fully open source and released under the MIT license.

I’d really appreciate any feedback, code reviews, or suggestions for improvement!

If you find the module useful, have ideas for future development, or are interested in collaborating on open-source projects, feel free to send me a DM or connect with me on GitHub. I’d be happy to chat!

Repository link: Modestox DeltaLog

Two months ago, I saw a lot of posts on LinkedIn about the revival of Magento, based on data from https://trends.builtwith.com/shop/Magento.

Honestly, I had doubts back then, thinking it was some changes to builtwith scripts/algorithms. Today, I have no doubts that it was some correlation.

The reasons for my doubts were a couple. First, a simple "Why?" 😄 Second, I hadn't seen a lot of new vacancies for Magento developers.

But if you look at 2018, there was a similar peak on the graph. I doubt that 40K stores were added in one moment and then the same amount removed.

What do you think? What is the reason for such spikes on the graph?

Adobe has release a new set op patches, with a 10.0 as the highest score for an RCE (Remote Code Execution). So .. update!

Mageinfo.online detects if the patch is implemented for the 2.4.9 release and some older ones. 2.4.8 cannot be detected, because in that version there is no functional change which can be detected.

I just completed several Magento site updates from 2.4.7 to 2.4.8-p5 including most of our extensions. After doing so I ran the Magento Security scan and found a couple of issues. One was a Patch APSB26-73 and the oher was a Failed Scan: Compromise, "BotNet Suspect".

I will attempt to install the Patch soon, however my biggest concern right now is the BotNet Suspect. Is anyone familiar with this and how to fix or remove it.

The crazy thing is I have an identical DEV Site that I am working with on the same server testing all the updates before doing so on the Live Site. I made a copy of the dev site from the live site just a few days or so ago. I also did a security scan on the dev site and the BotNet Suspect Passed.

Thanks for any support anyone can offer

Hey everyone,

I’m a certified Magento / Adobe Commerce full-stack developer with 7+ years of experience, looking for a new freelance project or a long-term remote role.

I can help with:

• Custom modules and functionality
• Performance optimization and Core Web Vitals
• Checkout fixes and payment integrations
• API and third-party integrations
• Debugging and improving legacy code
• Magento upgrades and store migrations
• AI automation and workflow integrations

My tech stack includes Magento 2 / Adobe Commerce, PHP, JavaScript, Hyvä, GraphQL, Redis, Elasticsearch, Docker, and AWS.

I focus on clean, maintainable code and keeping production stores stable. I’m available for specific fixes, larger development projects, or ongoing support.

If you’re looking for help with your Magento store, feel free to DM me with a brief overview of the project. Happy to discuss the scope and availability.

Hi all,

I´m using Magento for 10 years now, and doing all the work in site maintenance.
What I´ve noticed is even with the latest Magento version, your still vulnerable to all kind of attacks, if your not proactive monitoring the web traffic that reaches your store.

The patches and upgrades represent costs, instability in the store, that could compromise business.

The use of a firewall represent another layer, in contact with customers, that in comercial sense can have a toll in sales.

What´s yours experiences?

Lynx keeps Magento as the backend and renders the storefront as Vue or React components over Inertia.js, so there is no GraphQL layer and no separate frontend to host. Styling is Tailwind, pages come from a drag-and-drop page builder, and Server-Side Rendering runs on Node or a Cloudflare Worker.

Demo: https://lynx-demo.oocscommerce.com/

Feedback welcome.

Hello guys! I am a 17 years old from Romania, and all my life I developed dynamic webpages with PHP and presentation sites with frameworks of Javascript, in the past I have Laravel & Symfony as PHP frameworks. I am looking to start a new journey with Magento, for a job at 18, in 4 months, what resources do you recommend? what things should I look for? Where can I find the best resources & tutorials? Thank you.

I am wanting to use Magento's default 2FA for my Admin and for some reason it is not listed under Stores>Configuration>Security as it sould be. Is there a way I can get it enabled to show up so I can get it setup. I have seen it listed there before, now it has disapeared.

The only thing I can think of is some time in the past I installed Two-Factor Auth from Mageplaza and maybe that disabled it, idk.

Hi all,

I work at Limely, a Magento agency in the UK. For a while I've been building MageDrop, a tool for something our clients kept asking for: changing content across lots of entities, checking it all on the real storefront, then putting it live at the same moment.

Adobe Commerce has Content Staging, but on Open Source you usually end up editing live at midnight or doing it by hand and hoping nothing gets missed.

How it works

1. A companion module adds a "Stage to Release" & "Quick Preview" button to the admin edit forms for CMS pages, blocks, categories and products. You edit as normal. When you stage, the save is intercepted, nothing touches the live store, and only the fields you changed are saved to a release.

2. Preview the whole release on your actual storefront. This uses the X-Magento-Vary cookie, so full page cache keeps preview and live pages separate. Your customers never see staged content, and you see the real theme with real cache behaviour. It works on both Luma and Hyvä.

3. Deploy everything in one go, either right away or on a schedule (e.g. a sale that starts at 9am Friday). You can also set an end time, and it rolls back automatically.

Other bits

- Store view scope is supported, including "Use Default Value"

- A revision history is captured on every save, with field-level diffs and one-click rollback to any version

- Rollback puts back exactly what was there before the deploy, not just the last thing staged

- Scheduled deploys retry automatically if the store is briefly unreachable, and you get an email if a run fails

- Third-party form sections can be added through a section handler interface

Try it without installing anything

There's a live demo at https://www.magedrop.com/demo. You get the MageDrop dashboard and the admin of a real Magento store with the Luma sample catalogue. Edit a page, category or product, stage it to a release, preview it on the storefront, deploy it and roll it back.

The store is shared with other visitors. Deploys roll back automatically and everything resets overnight, so feel free to break things.

Install on your own store

composer require magedrop/magento2

Then you connect the store in the dashboard with a Magento integration. It only needs the MageDrop API permission.

It's free to use. I'd really like feedback from people running real stores: what breaks, what's missing, which entity types or extensions you'd want supported next.

Running 2.4.7 and have noticed when going to the Advanced Pricing page the "Special Price From" Calenders do not display when you click on the smaller calenders in the fields. I am having to manually enter the date in both fields. In my previous versions there use to be the pop ups where you can click the dates. Anyone have a fix or sugeestion for this

As of September 27, 2026, new information obligations regarding consumers will apply to retailers. Among other things, online retailers must provide clearer information about statutory warranty rights.

Furthermore, if a manufacturer offers a free commercial durability guarantee exceeding two years for the entire product and makes this information available to the retailer, details regarding this guarantee must also be provided via the harmonized GARAN label.

We released a modul today which covers the "warranty part" allready. More information can be found here (german).

What do you think? Are any of cour clients even aware of this new regulation?

https://www.konvis.de/magento-erweiterung-eu-informationspflichten-fuer-gewaehrleistungslabel-und-garan-label-gewerbliche-haltbarkeitsgarantien/