Magento News

Why CVE-2026-75650 Matters More Than Its CVE Number Suggests Patch advisories arrive in bulk, and bulk advisories train teams to skim. CERT-In's CIVN-2026-0458 is exactly that kind of document: a long list of Adobe products, a long list of CVEs, and a single CRITICAL rating covering all of them. The risk in skimming it is that one entry deserves a different response from the rest. The one line that changes the priority Buried in the description is a sentence that separates CVE-2026-75650 from its neighbours: it affects Adobe Commerce, Adobe Commerce B2B and Magento Open Source, it is a critic…

If your store runs Magento 2.4.6, it stopped receiving security patches on 11 August 2026. The one exception is Adobe Commerce, the paid edition, which gets one more year. Magento Open Source, the free edition, does not. So the decision in front of you is about exposure, not features: how long you are willing to run a checkout that nobody will fix when the next hole is found, and what it costs to stop. Who is out of support, and until when Adobe gives every 2.4 release three years of standard support, then stops shipping patches for it. For 2.4.6 and 2.4.7 it adds one extra year, but its life…

Half of a Magento store's traffic are bots, and today's scrapers solve puzzles and rent home internet. Here is the layered strategy we run, with real numbers. Every Magento store I run has more visitors that are bots than human. I used to say that as a joke. Then I counted. Across multiple production stores over a given period, only 19% of page requests came from a clean, ordinary browser. Another 31% were verified search engines, which we want. The remaining half was everything else: price scrapers, stock checkers, SEO tools, AI crawlers hoovering up product copy, credential stuffers, and a…

We have a model that retrieves the sender email address configured in the Magento Admin and uses it to send emails. This model is being called in three different ways: Cron CLI Admin When we manually trigger the functionality from the Admin, it correctly picks the default store email configured at: trans_email/ident_general/email However, when the same functionality is executed through Cron, it is picking an email address from a different source. While debugging in cron the path is stores/admin/trans_email/ident_general/email, and while in the admin the path is stores/0/trans_email/ident_gene…

The /graphql Precondition: Understanding the Attack Surface Behind CVE-2026-75650 Vulnerability overview CVE-2026-75650 is a critical vulnerability in Adobe Commerce and Magento Open Source. The ACSC classifies it as an Improper Neutralisation of Special Elements Used in a Template Engine leading to unauthenticated remote code execution, states that exploitation requires the /graphql endpoint to be exposed, and reports awareness of active exploitation. The vendor patch dates to 7 September 2026. Why the precondition is the interesting part Most RCE advisories are read as "patch this." This on…

Consolidating multiple Magento domains into a single, streamlined Adobe Commerce instance is a common strategic move for merchants aiming to reduce technical debt, improve backend scalability, and lower total cost of ownership. However, merging domains comes with significant SEO risks that can impact organic traffic, rankings, and revenue if not handled carefully. In this technical use case breakdown, I’ll walk through the challenges of Magento domain consolidation, share a proven approach to preserve SEO equity, and highlight key implementation notes for developers, solutions architects, and…

Stores still on M1/OpenMage have been locked out of everything commerce has added since 2020. This closes that gap, free and self-hosted. Install: composer require jestr-ai/openmage-ai-suite Source: https://github.com/jestr-ai/openmage-ai-suite What it gets you: Answers without building a report. Ask "what's low on stock and what sold in the last 90 days?" in Claude or ChatGPT and get it from the real database. No exports, no dev ticket. Product copy that stops being a chore. Generated from each product's real attributes, in bulk, into a review queue someone approves. A 1,000-SKU catalog beco…

Hello, we are proud to announce we developed a tool for Magento 2 webshops. It provides fresh insights that will help your webshop grow. It is called ShopReport. https://shopreport.3webapps.com/ ShopReport is a dashboard platform for online store owners, making it perfect for Shopify stores, that consolidates orders, inventory, customers, marketing, and search engine performance into a single, centralized environment. It features automatic background synchronization, smart alerts, and AI-powered insights. Instead of switching between the shop backend, Google Analytics, Search Console, a compe…

I'm doing some research on the current Magento 2 ecosystem and would like to hear from developers, agencies, and merchants. What kind of module or functionality do you think the community still needs today? submitted by /u/Nearby-Setting-158 [link] [comments]

The Wider Adobe Patch Wave Behind CVE-2026-75650 CVE-2026-75650 is the entry in CERT-In's CIVN-2026-0458 that demands immediate action, but it is not the only vulnerability in the advisory. Understanding the surrounding patch wave helps teams sequence the work and avoid treating the whole document as a single, undifferentiated task. The advisory at a glance CERT-In published CIVN-2026-0458 on September 16, 2026, rating it CRITICAL. It covers multiple vulnerabilities across Adobe Experience Manager, ColdFusion, Photoshop, Illustrator, Animate, Photoshop Mobile, Adobe Commerce, Magento Open Sou…

Patching Guide for CVE-2026-75650: Closing the Adobe Commerce RCE CVE-2026-75650 is a critical remote code execution vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. CERT-In's CIVN-2026-0458 rates the advisory CRITICAL and notes that Adobe has confirmed in-the-wild exploitation. This guide focuses on the practical work: identifying affected deployments, applying the fix and confirming it landed. What you are fixing The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on a vulnerable server. It affects the commerce platform line rath…

Hey! I am looking for a feedback on using MariaDB's DuckDB engine for faster reports in Magento. Here is my blog post on this matter. Looking forward to your opinion how much this might be useful to reduce TCO running reports close to transactional part. submitted by /u/drrtuy-b [link] [comments]

When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 Opening CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler, documented exploitation starting 4 September 2026. Adobe published the emergency hotfix VULN-39341 on 7 September 2026 under advisory APSB26-146. The relevant window is those three days. A store that was co…

I just shipped a new signal in Watchtower, my Magento monitoring tool: application_errors, which watches for a rising rate of caught exceptions your own code is logging, before that shows up anywhere else, like checkout. The feature itself is simple. Getting there across three supported Magento versions was not, and the two bugs I hit only showed up under live verification, not unit tests. Here's what happened. The goal: count exceptions without reading a log file Every existing signal in my connector observes Magento's event bus or polls a status table. This one is different: I wanted to kno…

Fashion accessories retailer on Magento 2, currently at €45M GMV across 3 markets, and our September promotional event is our biggest trading day of Q3, at 3 to 4 times normal order volume. And last week it lasted 2 hours before the site started timing out on checkout and most orders for the afternoon didn't go through. Our hosting provider pointed to database connection exhaustion under load, which our Magento devs confirmed is a known issue with Magento's session handling under high concurrency, and we've already got a patch in scope that should raise the ceiling before October. Except that…

submitted by /u/Boring-Ad-6591 [link] [comments]

We added: - RUM scores - GEO check, the "SEO" for AI search bots - Detection of Magento extensions used by the shop We improved: - Detection of the theme used: mageinfo can now also detect for example PWA and Luma/Porto - Detection of the Isolated security patches of July, August and September Check yourself at https://mageinfo.online Feedback welcome. submitted by /u/Boring-Ad-6591 [link] [comments]

Building a headless Magento setup (GraphQL + separate frontend) and stuck on a boring-but-important question. For site header / footer / simple nav — are you: Putting them in Magento CMS blocks so merchants edit in admin, or Keeping layout only in the frontend repo and treating Magento as catalog + checkout? I like admin-editable blocks for non-devs, but then you’re shipping HTML/JSON over GraphQL and dealing with store-view differences, caching, and "who owns the markup." Curious what people running headless in production actually chose, and what bit you later regretted. submitted by /u/jeni…

submitted by /u/Mearkat_ [link] [comments]

Just got a local Open Source 2.4.9 box running with sample data (markshust-style Docker) so I can poke GraphQL for a small headless experiment later. Machine only has 4 cores, so Magento + OpenSearch + MySQL all at once is spicy. A few things I ended up doing: - restart: "no" on everything + simple up/down scripts, so it doesn’t come back after reboot eating RAM - memory caps especially on OpenSearch (that one likes to hog) - don’t leave it running overnight GraphQL endpoint responds with sample catalog, which was the real "ok we're good" check for me. Curious what people do on smaller machin…