The latest in Magento land
Do you know that feeling? You worked long and hard on that blog post? Or that super wicked Magento extension? And then you hit publish and... nothing. No one reads it. No one sees it. It just sits there. Well, not anymore! Mage Dispatch is here to help you get your content out there.
Mage Dispatch is a newsletter for the community and by the community. Here you can share links that you think that the community should know about. We will include it in our next newsletter.
-
https://github.com/yellowteak/APSB26-146-patches
Pre-split APSB26-146 (VULN-39341) patches tailored for cweagans/composer-patches, organized per 2.4.4-p18 through 2.4.9 with a drop-in patches.json. Covers framework, base, backend, email, and newsletter packages, with steps to apply via Composer.
-
https://gist.github.com/pingiun/00cfbfdc3cf517807eb3b6bc24c7f295
Patch implementing explicit directive deferral and signing in the template filter to block unresolvable directives from being treated as deferred and executed by parent templates. Includes diffs for Framework Template and Email Template Filter, adapted for Composer installs and intended to be applied alongside APSB26-146.
-
https://dor.ky/post/cve-2026-75650-apsb26-patches-analysis
Details how APSB26-146 closes three issues—unsafe object instantiation reachable from CMS/email templates, untyped preview inputs, and writable error reports—and outlines patching steps plus checks to catch similar instantiate-then-check anti-patterns.
-
https://github.com/disrex-group/module-stylesmuggler-guard
Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.
-
https://helpx.adobe.com/security/products/magento/apsb26-146.html
Announces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
-
https://github.com/markshust/magento2-module-disabletwofactorauth
Auto-disables 2FA in developer mode and adds admin/CLI toggles to enable or disable 2FA—and API token generation—in other environments.
48228 -
https://github.com/Modracx/admin-dev-tools
A unified admin toolbar that puts cache management, indexers, logs and exception reports, cron health and on‑demand runs, DI/event wiring inspection, environment checks, mail catching, URL rewrite lookup, DB size audit, config lookup, activity audit, grid resets, and module toggling at your fingertips. The README includes installation commands, routes, and granular ACL permissions.
47 -
https://gist.github.com/rhoerr/291d29ef3bd201c96757cf262d92bdaf
Diff introduces SecurePathValidator to reject stream/writable paths during template rendering, blocks backend/adminhtml blocks in {{block}} directives, and neutralizes PHP tags in error reports. Also tightens DI/setup scanners and grid URL generator type checks to avoid unsafe class/path resolution.
-
https://github.com/graycoreio/magento2-style-smuggler-patch
Composer-installable module that mitigates the Style Smuggler vulnerability by allowlisting email template {{block}} classes, validating grid row URL generator classes, and neutralizing Web API fatal error report output. Includes setup steps and di.xml examples to allowlist needed email blocks and guidance on checking logs for refused classes.
-
https://github.com/muench-dev/StyleSmuggler
Three bash scripts to scan for IoCs and guide cleanup on servers, apply community mitigations via Composer patches and a hardening module, and remotely check GraphQL exposure. Includes DDEV/Warden support, cloud-friendly usage, and step-by-step confirmations.
110