security
-
https://github.com/mage2sk/module-malware-scanner
Signature-based scanner and file integrity monitor with quarantine, an admin findings grid, scheduled scans, and email alerts. Includes request-time guards for uploads, REST, and GraphQL to block webshells, polyglots, and other payloads before they reach disk.
2404 May 2026
-
https://www.samdjames.uk/blog/copy-fail-cve-2026-31431/
Explains the AF_ALG kernel bug that allows any local user to escalate to root. Provides an emergency mitigation (disable algif_aead with an Ansible snippet) and advises updating to patched kernels.
-
https://github.com/infinri/A.S.E
CLI that polls KEV, NVD, GHSA, OSV, and Packagist, filters results against your composer.lock, and scores with CVSS/EPSS/KEV. Sends only P0/P1 alerts to Slack and returns exit codes for CI gating.
11421 Apr 2026
-
https://gist.github.com/JeroenBoersma/d5c33066d7b0a7c69736a3d0f67ac9b1
NGINX config to block the Polyshell upload exploit at the edge, denying API and media paths regardless of location rules. Includes allowlisting, Hypernode/Maxcluster setup steps, and commands to scan affected paths and logs.
07 Apr 2026
-
https://github.com/sansecio/magevulndb
Magento is an attractive target for payment skimmers and the number of attacks has increased steadily since 2015. In 2018, attackers shifted from Magento core exploits (eg, Shoplift, brute force attacks on admin passwords) to 3rd party software components. This poses a practical problem: there is no central place where one can (programmatically) find out whether a particular module version has known security issues. This repository solves that!
3621124 Mar 2026
-
https://github.com/taurus-media/module-polyshell-fix
A Magento 2 module designed to address a potential security concern related to custom options. It ensures that custom option values are correctly validated before processing, preventing unauthorized 'file' type injections.
1324 Mar 2026
-
https://github.com/markshust/magento-polyshell-patch
Mitigates the PolyShell vulnerability (APSB25-94) — an unrestricted file upload in the Magento REST API that allows attackers to upload executable files via cart item custom option file uploads.
126324 Mar 2026
-
https://github.com/LBannenberg/magento2-composer-dashboard
This module provides a dashboard inside the Magento admin to view your composer packages: What packages are installed? Are they up to date? Are there any security advisories for these packages?
112 -
https://github.com/AquiveMedia/magento2-disable-customer-upload-controller
A Magento 2 security module that disables the unauthenticated customer address file upload endpoint to protect against CVE-2025-54236 (SessionReaper) and related file upload vulnerabilities.
11614 Nov 2025
-
https://www.sdj.pw/posts/magento2-patching/
Deploying patches is simple for in-house development teams or smaller Agencies maintaining only a few stores. Manually applying patches per project is simple, but doesn’t scale well. Both from time cost and security exposure perspectives.
11 Nov 2025
