Magento News

PHP's main stopgap for the first PHP2Shell bug (CVE-2026-109618) is to remove the memory limit by setting memory_limit=-1, somewhere applications can't change it. The usual advice is php_admin_value in the FPM pool. On a Magento store using the stock nginx config, that doesn't work. The value comes back as 756M, and ini_set() failing makes it look locked in. The real fix is updating PHP. PHP's words: "There are no complete mitigations, updating is the only safe choice." The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. But if you're waiting on a vendor backport and using this stopgap…

submitted by /u/teeinbluePOD [link] [comments]

Maho is a modern, open-source ecommerce platform, retrocompatible with the Magento1 framework, built on PHP 8.5, Symfony, Doctrine DBAL and 100% vanilla JS, and it runs on MySQL, MariaDB, PostgreSQL or SQLite. We're following our 2 month release schedule with a new big one, bundling: AI assistant for the backend using our brand new APIPlatform based APIs, with a strict approval procedure when modifying data, context awareness and backend navigation system so that it can guide you in the backend and modify stuff for you on the screen and so much more. Visual page builder for CMS pages, blocks…

Migrating an Adobe Commerce storefront from a third-party page builder to Magento’s native Page Builder presents a unique set of technical challenges and opportunities. As Magento developers and eCommerce managers, understanding the migration risks, implementation details, and operational benefits is critical to reducing technical debt and improving performance and SEO outcomes. In this article, I’ll walk through a practical use case of migrating from a third-party page builder to Magento’s native Page Builder. We’ll cover the problem context, strategic approach, key implementation notes, and…

Disclosure: we build and maintain the module (Catalog Completeness, OSL-3.0, free on Packagist). This post is about what the bench turned up on Mage-OS, which applies to any extension with plugins. What we ran: a fresh install of the latest patch of each Mage-OS minor line (1.0.6, 1.1.1, 1.2.0, 1.3.1, 2.0.0, 2.1.0, 2.2.2, 2.3.0, 3.0.0 through 3.6.0, and 4.0.0 on PHP 8.4 and 8.5), then composer require, setup, 16 scripted phases, both indexer modes, uninstall, re-install, an admin walk and a log check. 17 benches. Result: 4.0.0 passed unchanged. On the older lines, two things that are Mage-OS,…

Released: 2026-10-30 Upstream: Magento Open Source 2.4.9 Please see the 4.0 announcement and release notes at https://mage-os.org/releases/2026-10-30-mage-os-4-0-0-release/ What's Changed in mageos-magento2 Allow extending MySQL client config in the integration test framework by @rhoerr in #315 Speed up setup:di:compile by removing repeated di.xml parsing by @rhoerr in #338 Fix #303: native WebP and AVIF support for image upload and processing by @jeanmarcos-dev in #317 Decouple Magento_Customer from Magento_Wishlist: move new-account-email plugin registration by @pingiun in #286 Do not cache…

Magento offers a lot of flexibility, but managing a store can become complicated as the number of products, extensions, and integrations increases. For developers and store owners, what takes the most time in your experience? Is it performance optimization, extension compatibility, upgrades, checkout customization, or something else? submitted by /u/HolidayCellist8600 [link] [comments]

Article URL: https://github.com/mercurjs/magento2-connector Comments URL: https://news.ycombinator.com/item?id=50339757 Points: 1 # Comments: 0

Magento Open Source 2.4.9 is the most demanding PHP application most teams will ever self-host. A working store needs a specific PHP version with a long list of extensions, a supported MariaDB or MySQL, a running OpenSearch cluster, Composer, a web server that understands Magento's pub/ layout, production-mode compilation, static content deployment and a cron job that runs every minute. This guide covers both routes on Ubuntu 24.04 LTS: what a manual installation involves step by step, and how to get the same store running from a single form with Hanoo on a server you own. Either way, you end…

We've released Catalog Completeness, a free Magento Open Source module: PIM-style completeness scoring inside Magento. It scores every product 0 to 100 against weighted rules you write (present, minimum length, image count, greater than 0, allowed values, regex), then lists what's missing, lowest score first. Channel profiles add per-channel scores, with suggested rules for Google Merchant Center, Amazon, eBay and five others. A periodic rescore runs from Magento cron (every six hours by default) for changes that bypass product saves, a "No rules assigned" view lists products no rule set cove…

We've released Catalog Completeness, a free Magento Open Source module: PIM-style completeness scoring inside Magento. It scores every product 0 to 100 against weighted rules you write (present, minimum length, image count, greater than 0, allowed values, regex), then lists what's missing, lowest score first. Channel profiles add per-channel scores, with suggested rules for Google Merchant Center, Amazon, eBay and five others. A periodic rescore runs from Magento cron (every six hours by default) for changes that bypass product saves, a "No rules assigned" view lists products no rule set cove…

So you know the person behind it. Not a sales pitch, just what StoreFrame is to me: a home for my team, my notes as working code, and the impossible thing I'm glad I tried to build. Heads up: this isn't a product page and it isn't a sales pitch. It's me talking about the thing I've spent years building, with the emotions left in, including a swear word or two. If you're looking for features and pricing, the rest of the site has you covered. This one is just human. It's my digital home StoreFrame, for me, is home. It's where I'm connected with my remote team, my customers, my partners and my o…

I'm exploring different online business websites and would like to understand what makes a website useful, trustworthy, and easy to navigate for customers. When evaluating a business website such as coynn.com, what key factors should I consider regarding website performance, user experience, security, and overall business credibility? For Magento store owners and developers, which tools or best practices do you recommend for assessing these areas and improving the customer experience? I'd appreciate any suggestions or practical advice from the community. Thanks!

Decision needed this week CVE-2026-48356, nicknamed PolyShell, lets anyone on the internet upload a file to a Magento or Adobe Commerce store through its public shopping-cart API, with no login. On many servers that file becomes a backdoor that criminals use to plant card skimmers. Attacks have been running since March 2026, and on 27 October CISA added it to its list of actively exploited flaws, with a 10 November deadline for US federal agencies. If your store has not installed Adobe’s July 2026 security update (APSB26-73), treat it as urgent, and check for signs of compromise even if you h…

I'm working on understanding the best ways to improve storefront performance in Magento 2. Slow page loads can affect the shopping experience, so I'd like to learn which areas should be investigated first. My questions are: How can I identify whether slow page loads are caused by extensions, database queries, or frontend assets? Which Magento 2 built-in caching features should I verify? What tools or commands are useful for diagnosing performance bottlenecks? I'd appreciate practical steps and recommendations for troubleshooting a Magento 2 store. For content-focused websites, such as one pro…

submitted by /u/Excellent_Word5756 [link] [comments]

I built a Magento 2 module that lets other sellers list on your store. Magento stays as it is, no replatforming, MIT license. Installs with composer, works on Magento 2 and Adobe Commerce. Magento stays your commerce engine and the system of record. Sellers and their offers are mirrored in, shown on the product page and in the cart, and the order goes to the marketplace side only after it has been placed in Magento. The marketplace part is covered by Mercur - an open-source marketplace platform on Medusa.js. GitHub: https://github.com/mercurjs/magento2-connector Docs: https://docs.mercurjs.co…

We have integrated Dynamics 365 with Magento, where contacts are synchronized as Magento customers along with their billing and shipping addresses. We are facing a challenge with address synchronization because Dynamics 365 uses a single Full Name field, which can contain either a person's name for a residential address or a company name for a commercial address. In Magento, however, addresses have separate fields for First Name, Last Name, and Company. Here are the two scenarios we need to handle: Residential Address Map the Full Name value from Dynamics 365 to the First Name and Last Name f…

CISA added two severe vulnerabilities to its KEV catalog: CVE-2026-48356 in Adobe Commerce/Magento and CVE-2026-111497 in Google Brotli. Review the details, PolyShell infection vectors, cloud exposure statistics from Wiz, and multi-vendor patch advisories including Node.js. The problem in the Brotli library The first issue concerns the Brotli data compression tool, which is widely used in a number of applications and services worldwide. This vulnerability, known as Node2Shell, HTTP2Shell or Broccoli2Shell, could allow an attacker to corrupt a system's memory, cause a system crash, or even exe…

CVE-2026-48356 is a file upload flaw in Adobe Commerce and Magento, and CISA lists it as exploited. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-27. If you run either product, find Adobe's bulletin for this CVE and apply its fix or mitigation. Published 2026-10-28. Reviewed by the Buy Exam Voucher security editor. We will update this article when Adobe's version details are available to us. What happened CVE-2026-48356 is an unrestricted upload of file with dangerous type vulnerability. The public record says it could allow arbitrary code execution in the cont…