security
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-138.htmlOfficial bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
https://scandiweb.com/blog/stylesmuggler-fix-for-older-magento-versions/
Offers 41 version-specific patches that backport the official StyleSmuggler (CVE-2026-75650) hotfix to unsupported 2.2.0–2.4.3-p3, with apply steps and guidance on mandatory credential rotation after patching.
-
https://github.com/disrex-group/module-stylesmuggler-guard
Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.
-
https://github.com/markshust/magento2-module-disabletwofactorauth
Auto-disables 2FA in developer mode and adds admin/CLI toggles to enable or disable 2FA—and API token generation—in other environments.
48228 -
https://github.com/muench-dev/StyleSmuggler
Three bash scripts to scan for IoCs and guide cleanup on servers, apply community mitigations via Composer patches and a hardening module, and remotely check GraphQL exposure. Includes DDEV/Warden support, cloud-friendly usage, and step-by-step confirmations.
17 -
https://gist.github.com/ProxiBlue/07373c92c8c70dc746bbfdcd1f07b789
Patch enforcing CLI-only execution for DI scanners to mitigate StyleSmuggler, adding PHP_SAPI checks in ArrayScanner, ClassesScanner, and XmlInterceptorScanner.
-
https://github.com/TonyMerlin/M2-AdminFileManager
Adds an admin-area file browser and text editor with clickable breadcrumbs, ACL-controlled view/edit access, and a detailed activity log. Enforces strict security with path validation, a sensitive-file denylist, and allowlisted text types only—no upload, delete, or rename actions.
13 -
https://www.samdjames.uk/blog/magento-ai-operational-maturity/
A priority-ordered roadmap for using AI at speed without chaos: automated deployments, ephemeral environments, E2E and unit tests, static analysis, and security tooling. Explains what “good” looks like, what breaks without each layer, and where to start.
-
https://github.com/Space48/magento2-sso
Adds SAML-based single sign-on for backend users, compatible with IdPs like Auth0, OneLogin, and Amazon SSO. Install via composer and configure under Stores > Configuration > Advanced > Admin > Single Sign-on.
719 -
https://mageinfo.online/
Instantly checks if your shop is up to date, flags known CVEs, and reviews server configuration, including full DNS analysis.
-
https://github.com/yellowteak/magento2-change-customer-password
Adds a Change Password tab to the customer edit page in admin so support can reset a customer's password with re-auth confirmation. Includes composer install, enablement, and configuration steps.
26