security-patch
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-138.htmlOfficial bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-146.htmlAnnounces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
-
https://gist.github.com/rhoerr/291d29ef3bd201c96757cf262d92bdaf
Diff introduces SecurePathValidator to reject stream/writable paths during template rendering, blocks backend/adminhtml blocks in {{block}} directives, and neutralizes PHP tags in error reports. Also tightens DI/setup scanners and grid URL generator type checks to avoid unsafe class/path resolution.
-
https://github.com/graycoreio/magento2-style-smuggler-patch
Composer-installable module that mitigates the Style Smuggler vulnerability by allowlisting email template {{block}} classes, validating grid row URL generator classes, and neutralizing Web API fatal error report output. Includes setup steps and di.xml examples to allowlist needed email blocks and guidance on checking logs for refused classes.
-
https://github.com/disrex-group/stylesmuggler-mitigation/tree/main
Step-by-step detection and cleanup for the unauthenticated RCE, plus nginx/Apache rules to block active campaigns and a Composer module/patch that makes DI scanners CLI-only (works on 2.4.6–2.4.9).
-
https://gist.github.com/ProxiBlue/07373c92c8c70dc746bbfdcd1f07b789
Patch enforcing CLI-only execution for DI scanners to mitigate StyleSmuggler, adding PHP_SAPI checks in ArrayScanner, ClassesScanner, and XmlInterceptorScanner.
-
https://github.com/brideo/stylesmuggler-patch
Stopgap hardening package for the Sansec‑disclosed StyleSmuggler RCE: Nginx/Apache request filters, a DI‑scanner CLI guard, a sanitizing module, and scripts for compromise checks, containment, and DB audits. Includes deployment, testing, and incident‑response runbooks; designed to be removed once an official fix ships.
12 -
https://github.com/SamJUK/m2-meta-security-patches
Composer meta package bundling isolated monthly and emergency security fixes into one dependency via vaimo/composer-patches. Includes install and source-restriction steps, details on patch adjustments and reapplying after vendor resets, plus coverage for CVEs like CosmicSting.
323 -
https://github.com/qoliber/2026-07-001-CE-cweagans-patches#
Provides per-package patch sets for the July 2026 security release, compatible with cweagans/composer-patches, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5, and 2.4.9 (including B2B). Includes composer.json snippets, application steps, and notes on nginx.conf.sample and the omitted patch-status script.
17 -
https://github.com/aregowe/magento2-module-polyshell-protection
Defense-in-depth module that blocks the PolyShell unrestricted file upload attack with layered checks: request/media path blocking, strict filename/extension validation, and polyglot content detection. Provides Composer install steps, admin-configurable allow/block lists, logging, and migration from markshust/polyshell-patch.
968