A while back I posted about Lynx, the single-page app storefront we've been building for Magento 2. The first version is now released.

- Runs inside Magento: no separate frontend app or hosting like a PWA

- React or Vue components

- Drag-and-drop builder for every page, not just CMS pages

- One-page fast checkout

- MCP support for building pages with Claude, plus public Claude skills for third-party module compatibility: https://github.com/oocscommerce/claude-skills

- 95+ mobile PageSpeed on the demo

Demo: https://lynx-demo.oocscommerce.com/

Docs: https://docs.oocscommerce.com/lynx/

Free license, no credit card: https://www.oocscommerce.com/lynx-magento.html

Thanks to everyone who gave feedback on the earlier post. Bug reports and questions are very welcome

I am needing to update all the monthly security patch releases they have released since July ASAP.

I have successfully updated my site from 2.4.7 to 2.4.8-p5 on my own and have several other updates in the past, however applying these updates looks a little different to me and I have yet to figure the best and simplest possible way to this.

One of the more important patches I need is for StyleSmuggler as it appears I may have got hit with it. While I know the patch will not clean it, I still need the protection for it along with an alert I received that APSB26-73 (July Patch, I believe) is not installed.

Anyone with east to follow steps to patch all patches available, please suggest.

Hi everyone!

I’d like to share an open-source module for OpenMage / Magento 1 that I recently built for a real-world project and published on GitHub: Modestox_DeltaLog.

To be transparent, I’m not claiming this module is revolutionary or that it’s a commercial-grade product. I built it to solve a practical problem in a live project, while also contributing to my portfolio and growing my open-source presence.

What problem does it solve?

In stores managed by multiple admins or managers, it’s a familiar story: someone changes an order status, a product price, or a customer group, and later there’s no easy way to determine who made the change.

Existing auditing solutions can sometimes be overly complex, generate excessive database writes, or introduce unnecessary overhead whenever an object is saved.

What does the module do?

Modestox_DeltaLog tracks selected data changes, recording:

• Who made the change (admin, customer, Cron, or CLI)
• When it happened
• Source IP address, where available
• What changed, including previous and updated values

Key features

• Performance-focused: Tracking rules are compiled into the OpenMage cache, reducing the need for database lookups on every object save.
• Automated log cleanup: A scheduled Cron job purges outdated logs daily according to a configurable retention period.
• PHP 8.3 compatibility: The codebase uses strict typing throughout.

A note on testing

I’ve tested the module against my own use cases, and it works well for the scenarios it was designed to handle. That said, it hasn’t been extensively tested against every possible edge case, unusual third-party module configuration, or high-load environment.

The module is fully open source and released under the MIT license.

I’d really appreciate any feedback, code reviews, or suggestions for improvement!

If you find the module useful, have ideas for future development, or are interested in collaborating on open-source projects, feel free to send me a DM or connect with me on GitHub. I’d be happy to chat!

Repository link: Modestox DeltaLog

Two months ago, I saw a lot of posts on LinkedIn about the revival of Magento, based on data from https://trends.builtwith.com/shop/Magento.

Honestly, I had doubts back then, thinking it was some changes to builtwith scripts/algorithms. Today, I have no doubts that it was some correlation.

The reasons for my doubts were a couple. First, a simple "Why?" 😄 Second, I hadn't seen a lot of new vacancies for Magento developers.

But if you look at 2018, there was a similar peak on the graph. I doubt that 40K stores were added in one moment and then the same amount removed.

What do you think? What is the reason for such spikes on the graph?

Adobe has release a new set op patches, with a 10.0 as the highest score for an RCE (Remote Code Execution). So .. update!

Mageinfo.online detects if the patch is implemented for the 2.4.9 release and some older ones. 2.4.8 cannot be detected, because in that version there is no functional change which can be detected.

I just completed several Magento site updates from 2.4.7 to 2.4.8-p5 including most of our extensions. After doing so I ran the Magento Security scan and found a couple of issues. One was a Patch APSB26-73 and the oher was a Failed Scan: Compromise, "BotNet Suspect".

I will attempt to install the Patch soon, however my biggest concern right now is the BotNet Suspect. Is anyone familiar with this and how to fix or remove it.

The crazy thing is I have an identical DEV Site that I am working with on the same server testing all the updates before doing so on the Live Site. I made a copy of the dev site from the live site just a few days or so ago. I also did a security scan on the dev site and the BotNet Suspect Passed.

Thanks for any support anyone can offer

Hey everyone,

I’m a certified Magento / Adobe Commerce full-stack developer with 7+ years of experience, looking for a new freelance project or a long-term remote role.

I can help with:

• Custom modules and functionality
• Performance optimization and Core Web Vitals
• Checkout fixes and payment integrations
• API and third-party integrations
• Debugging and improving legacy code
• Magento upgrades and store migrations
• AI automation and workflow integrations

My tech stack includes Magento 2 / Adobe Commerce, PHP, JavaScript, Hyvä, GraphQL, Redis, Elasticsearch, Docker, and AWS.

I focus on clean, maintainable code and keeping production stores stable. I’m available for specific fixes, larger development projects, or ongoing support.

If you’re looking for help with your Magento store, feel free to DM me with a brief overview of the project. Happy to discuss the scope and availability.

Hi all,

I´m using Magento for 10 years now, and doing all the work in site maintenance.
What I´ve noticed is even with the latest Magento version, your still vulnerable to all kind of attacks, if your not proactive monitoring the web traffic that reaches your store.

The patches and upgrades represent costs, instability in the store, that could compromise business.

The use of a firewall represent another layer, in contact with customers, that in comercial sense can have a toll in sales.

What´s yours experiences?

Lynx keeps Magento as the backend and renders the storefront as Vue or React components over Inertia.js, so there is no GraphQL layer and no separate frontend to host. Styling is Tailwind, pages come from a drag-and-drop page builder, and Server-Side Rendering runs on Node or a Cloudflare Worker.

Demo: https://lynx-demo.oocscommerce.com/

Feedback welcome.

Hello guys! I am a 17 years old from Romania, and all my life I developed dynamic webpages with PHP and presentation sites with frameworks of Javascript, in the past I have Laravel & Symfony as PHP frameworks. I am looking to start a new journey with Magento, for a job at 18, in 4 months, what resources do you recommend? what things should I look for? Where can I find the best resources & tutorials? Thank you.

I am wanting to use Magento's default 2FA for my Admin and for some reason it is not listed under Stores>Configuration>Security as it sould be. Is there a way I can get it enabled to show up so I can get it setup. I have seen it listed there before, now it has disapeared.

The only thing I can think of is some time in the past I installed Two-Factor Auth from Mageplaza and maybe that disabled it, idk.

Hi all,

I work at Limely, a Magento agency in the UK. For a while I've been building MageDrop, a tool for something our clients kept asking for: changing content across lots of entities, checking it all on the real storefront, then putting it live at the same moment.

Adobe Commerce has Content Staging, but on Open Source you usually end up editing live at midnight or doing it by hand and hoping nothing gets missed.

How it works

1. A companion module adds a "Stage to Release" & "Quick Preview" button to the admin edit forms for CMS pages, blocks, categories and products. You edit as normal. When you stage, the save is intercepted, nothing touches the live store, and only the fields you changed are saved to a release.

2. Preview the whole release on your actual storefront. This uses the X-Magento-Vary cookie, so full page cache keeps preview and live pages separate. Your customers never see staged content, and you see the real theme with real cache behaviour. It works on both Luma and Hyvä.

3. Deploy everything in one go, either right away or on a schedule (e.g. a sale that starts at 9am Friday). You can also set an end time, and it rolls back automatically.

Other bits

- Store view scope is supported, including "Use Default Value"

- A revision history is captured on every save, with field-level diffs and one-click rollback to any version

- Rollback puts back exactly what was there before the deploy, not just the last thing staged

- Scheduled deploys retry automatically if the store is briefly unreachable, and you get an email if a run fails

- Third-party form sections can be added through a section handler interface

Try it without installing anything

There's a live demo at https://www.magedrop.com/demo. You get the MageDrop dashboard and the admin of a real Magento store with the Luma sample catalogue. Edit a page, category or product, stage it to a release, preview it on the storefront, deploy it and roll it back.

The store is shared with other visitors. Deploys roll back automatically and everything resets overnight, so feel free to break things.

Install on your own store

composer require magedrop/magento2

Then you connect the store in the dashboard with a Magento integration. It only needs the MageDrop API permission.

It's free to use. I'd really like feedback from people running real stores: what breaks, what's missing, which entity types or extensions you'd want supported next.

Running 2.4.7 and have noticed when going to the Advanced Pricing page the "Special Price From" Calenders do not display when you click on the smaller calenders in the fields. I am having to manually enter the date in both fields. In my previous versions there use to be the pop ups where you can click the dates. Anyone have a fix or sugeestion for this

As of September 27, 2026, new information obligations regarding consumers will apply to retailers. Among other things, online retailers must provide clearer information about statutory warranty rights.

Furthermore, if a manufacturer offers a free commercial durability guarantee exceeding two years for the entire product and makes this information available to the retailer, details regarding this guarantee must also be provided via the harmonized GARAN label.

We released a modul today which covers the "warranty part" allready. More information can be found here (german).

What do you think? Are any of cour clients even aware of this new regulation?

https://www.konvis.de/magento-erweiterung-eu-informationspflichten-fuer-gewaehrleistungslabel-und-garan-label-gewerbliche-haltbarkeitsgarantien/

Stores still on M1/OpenMage have been locked out of everything commerce has added since 2020. This closes that gap, free and self-hosted.

Install:

composer require jestr-ai/openmage-ai-suite

Source:

https://github.com/jestr-ai/openmage-ai-suite

What it gets you:

• Answers without building a report. Ask "what's low on stock and what sold in the last 90 days?" in Claude or ChatGPT and get it from the real database. No exports, no dev ticket.
• Product copy that stops being a chore. Generated from each product's real attributes, in bulk, into a review queue someone approves. A 1,000-SKU catalog becomes an afternoon.
• Customers who get answers at 2am. Storefront chat that searches the live catalog, quotes real prices, tracks orders and adds to cart. Works on any theme.
• - Being findable when people shop through AI. Product feed, llms.txt and a catalog API so shopping agents can read the inventory instead of skipping the store.

Bring your own key (Anthropic / OpenAI / Gemini / local). Nothing phones home. Every AI token runs as a specific admin user with that user's permissions, writes are off by default and need explicit confirmation, and everything is audited.

OpenMage 20.x/21.x on PHP 8.1+.
Won't run for now on stock 1.9 / PHP 7.x.

MIT licensed, contributions welcome.

I'm doing some research on the current Magento 2 ecosystem and would like to hear from developers, agencies, and merchants.

What kind of module or functionality do you think the community still needs today?

Hey! I am looking for a feedback on using MariaDB's DuckDB engine for faster reports in Magento. Here is my blog post on this matter. Looking forward to your opinion how much this might be useful to reduce TCO running reports close to transactional part.

Building a headless Magento setup (GraphQL + separate frontend) and stuck on a boring-but-important question.

For site header / footer / simple nav — are you:

1. Putting them in Magento CMS blocks so merchants edit in admin, or

2. Keeping layout only in the frontend repo and treating Magento as catalog + checkout?

I like admin-editable blocks for non-devs, but then you’re shipping HTML/JSON over GraphQL and dealing with store-view differences, caching, and "who owns the markup."

Curious what people running headless in production actually chose, and what bit you later regretted.

We added:

- RUM scores

- GEO check, the "SEO" for AI search bots

- Detection of Magento extensions used by the shop

We improved:

- Detection of the theme used: mageinfo can now also detect for example PWA and Luma/Porto

- Detection of the Isolated security patches of July, August and September

Check yourself at https://mageinfo.online

Feedback welcome.

Just got a local Open Source 2.4.9 box running with sample data (markshust-style Docker) so I can poke GraphQL for a small headless experiment later.

Machine only has 4 cores, so Magento + OpenSearch + MySQL all at once is spicy. A few things I ended up doing:

- restart: "no" on everything + simple up/down scripts, so it doesn’t come back after reboot eating RAM

- memory caps especially on OpenSearch (that one likes to hog)

- don’t leave it running overnight

GraphQL endpoint responds with sample catalog, which was the real "ok we're good" check for me.

Curious what people do on smaller machines:

- drop RabbitMQ / Mailcatcher for day-to-day?

- OpenSearch memory sweet spot you actually use?

- or just accept Warden/markshust defaults and buy more RAM?

Not looking for hosting advice — purely local dev workflow tips.

Hi there

wonder, what is your experience with MGT-Commerce as a hosting provider for relatively complex Magento website?

What is good, what is bad?

I did a bit of research and on review websites only found one recent very negative review (TrustPilot) so far.

We're on Magento 2.4, somewhere around 40K SKUs across 3 brand sites, and lately every change we push touches something else and breaks it.

Performance is in there, but more than that, every new requirement needs either a heavy extension or a custom build, and with each one the codebase gets harder to deal with.

What's making me question the long-term picture is the Adobe trajectory, because the feature pace feels slow for where the licensing sits, the roadmap energy is clearly pulling toward Adobe Commerce Cloud, and the open-source community has been treading water for a couple of years compared to where it was.

We've started mapping out what a migration would even look like, and Shopware 6 is what most people here push, commercetools is the default from the agency side, and SCAYLE came up too once we started digging into what the ABOUT YOU team built before spinning it off.

Whatever direction you go, it's not cheap or fast, so nothing's moving yet, but wondering whether those of you on serious Magento setups still see it as a long-term bet or if you're in the same holding pattern.

Hi All,

I'm a Senior Magento2/Adobe Commerce/PHP Backend Developer with 10 years of experience from Sri Lanka and I'm actively looking for a new opportunity. From 2020, I have been working as a remote developer, providing my services to customers based in Australia, Singapore, Indonesia and Philippines through two IT agencies.

I have no plans to relocate, so I do not require any visa sponsorship. I'm happy to continue working remotely from Sri Lanka and I'm Flexible to work according to your required working hours/time zone.

Thanks

Do you think Sansec could help here?

Adobe really needs to take security issues more seriously and invest more resources into addressing them proactively. Every RCE can result in significant financial and reputational damage, which can easily outweigh the cost of fixing these vulnerabilities properly before they are exploited. Waiting until after an incident to act is much more expensive.