The latest in Magento land
Do you know that feeling? You worked long and hard on that blog post? Or that super wicked Magento extension? And then you hit publish and... nothing. No one reads it. No one sees it. It just sits there. Well, not anymore! Mage Dispatch is here to help you get your content out there.
Mage Dispatch is a newsletter for the community and by the community. Here you can share links that you think that the community should know about. We will include it in our next newsletter.
-
https://github.com/DeployEcommerce/module-prevent-customer-address-file-upload
This is a Magento 2 extension that prevents file uploads to /customer/address_file/upload endpoint which is used in combination with an flaw in Magento's logic to upload code and then execute it for CVE-2025-54236.
11 Nov 2025
-
https://github.com/boxtwentytwo/m2-cloudflare-turnstile
A module for Magento 2 that extends the built-in reCAPTCHA support to add Cloudflare Turnstile, an alternative privacy-friendly solution.
1511 Nov 2025
-
https://github.com/dadolun95/magento2-hreflang
This module manages alternate URLs for homepages, CMS pages, product pages, and category pages.
11 Nov 2025
-
https://github.com/zero1limited/Zero1_OpenPos
We created OpenPOS to solve some headaches experienced by a few of our wonderful customers. The profound set of circumstances around timing and speed of delivery caused us to quickly widen our horizons and produce a fully Open Source EPOS.
41111 Nov 2025
-
https://github.com/tddwizard/magento2-fixtures
A goodie but oldie: An alternative to the procedural script based fixtures in Magento 2 integration tests. It aims to be: extensible, expressive, easy to use
3214528 Oct 2025
-
https://github.com/rubenzantingh/RubenZantingh_AdminModuleList
This module provides a comprehensive overview of installed and active modules within your Magento instance.
28 Oct 2025
-
https://github.com/furan917/Magento2-ReadWriteSplit
A Magento 2 module that implements automatic read/write database splitting. Read queries are distributed across multiple read replicas using round-robin selection, while write operations always go to the master database. CLI operations (indexing, cron, console commands) always use the master to avoid temporary table conflicts. We ensure a 'writer first' approach and include a writer fallback for defensive posturing. It is built to support multiple readers, but 1 will work just as well.
28 Oct 2025
-
https://slcyber.io/assetnote-security-research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/
A recent vulnerability in Adobe's e-commerce platform, identified as CVE-2025-54236, poses risks of remote code execution, particularly through file-based session storage, which can be exploited by unauthenticated users. The article analyzes the patch related to this vulnerability, its deserialization mechanisms, and offers insights into potential exploitation methods and vulnerabilities remaining in the application. The narrative provides a deep dive into the exploit chain and necessary payloads while exploring the implications of session management and type handling in the context of security.
28 Oct 2025
