Magento 2 security patches · Lead Magento 2 developer · Adobe Commerce Expert certified
I apply the current Adobe security patches and PHP security updates to your Magento 2 store on a staging copy first, test checkout and everything that earns money, and release to production in a maintenance window you choose. Usually done within two business days, for a fixed price agreed before I start.
Unpatched stores are how card skimmers get in. Every Adobe security bulletin is public, and as soon as it is out, automated scanners start looking for Magento stores that have not applied it yet.
CosmicSting in 2024 and SessionReaper in 2025 were both turned into automated attacks within weeks of the fix. The stores that were hit were not unlucky. They were simply behind on patches, sometimes by a single bulletin.
Regular bulletins arrive on Adobe’s monthly patch day, as -p releases or isolated patches, and urgent hotfixes come in between. A hotfix is not always part of the next monthly patch, so a store can look patched and still be exposed.
Magento runs on PHP, and PHP has its own security releases. In October 2026, PHP2Shell hit every Magento store with two critical bugs that no Magento patch fixes. I update PHP to a patched build as part of the job.
| Vulnerability | What it is | How it is fixed |
|---|---|---|
| CosmicSting CVE-2024-34102 | XML external entity flaw, rated 9.8 out of 10, used to steal the store’s encryption key and plant card skimmers. Mass exploited from July 2024. | Adobe bulletin APSB24-40, then a rotated encryption key. The patch alone does not lock out an attacker who already has the key. |
| SessionReaper CVE-2025-54236 | Customer session takeover through the REST API without logging in, rated 9.1. Automated attack attempts followed within weeks. | Out-of-band hotfix in Adobe bulletin APSB25-88, September 2025 |
| Emergency hotfix APSB26-146 | Remote code execution without authentication, rated 10.0, already exploited when Adobe published it on 7 September 2026. | Separate hotfix, not included in the October 2026 isolated patch |
| October 2026 APSB26-153 | 11 vulnerabilities, 5 of them critical, published on Adobe’s October patch day. | Isolated patch for each supported release line, on top of the latest -p release |
| PHP2Shell CVE-2026-109618 CVE-2026-109619 | Two critical bugs in PHP itself, triggered before Magento even runs. No Magento patch helps. | Your distribution’s patched PHP build, verified on the PHP that serves your pages |
Not sure where your store stands? Magento security patches: which ones you are missing explains how to check in a few minutes. Or send me your exact version and I check it for you as part of the quote.
The fixed price covers everything below. If something outside it turns up, for example a release line that no longer receives patches, you hear about it before any work starts.
-p level, the patches already applied, Adobe’s patch status tool where available, and the bulletins and hotfixes your store is still missing. You get the list in writing.-p release of your line where needed, then the monthly isolated patches and every separate hotfix, in the order Adobe gives, for Open Source, Adobe Commerce, B2B or Mage-OS.vendor/ on the server, so the next deployment does not quietly remove them.Your store URL and, if you have it, the output of bin/magento --version. I check what is missing and confirm a fixed price within one business day.
Security patches, hotfixes and PHP updates go onto a staging copy of your store first. Theme overrides and custom code are checked against the fix.
I run the checkout and admin checks, you click through staging if you want to, and you choose the release window.
Production release with a backup and rollback ready, then logs and orders watched, and a written confirmation of what was applied.
Starting prices below. The exact figure follows a quick check of your version and setup, fixed, and it does not move unless the scope does.
Fixed price
Patch check, Adobe security patches and hotfixes, PHP security updates, theme and custom code checked, tested on staging, released in your window. Usually done within two business days.
from €350
Get patched →Ongoing
Every Adobe patch day and every urgent hotfix handled for you, together with bug fixes, small features, extension updates and monitoring. Flat monthly fee, defined response times, plans from 16 hours a month.
from €990 / month
Ask about a retainer →How far behind the store is: missing one monthly patch is a different job from catching up several -p releases. Then theme overrides and custom code around the patched areas, Adobe Commerce Cloud or B2B, and whether a staging copy already exists. If your release line no longer receives patches, the fix is an upgrade to a supported 2.4.x, quoted separately.
You need the exact version, including the -p part, and a list of what was applied on top of it. Then you compare it with Adobe’s current bulletins. I describe the whole check in Magento security patches: which ones you are missing. If you would rather not, send me the version and the store URL and I tell you what is missing as part of the quote.
If it was on Magento 2.4.7 or earlier without the June 2024 fix (APSB24-40), yes. And if it ran unpatched during the attacks that summer, patching is not enough: the attack steals the encryption key from the server, so the key has to be rotated as well. I rotate it as part of the job, and if the store’s history suggests it was compromised, I tell you before release and quote a check for planted skimmer code separately.
Not while I work; everything happens on a staging copy. The production release is a short maintenance window, usually well under an hour, at a quiet time you choose, with a backup taken just before and the previous release ready to switch back to.
Not with official patches: Adobe’s current fixes for Open Source start at 2.4.7. The real fix is an upgrade to a supported 2.4.x release or a move to the current Mage-OS release, which ports Adobe’s fixes within days. Porting the patch files to an older line by hand works as a stopgap for a few weeks, and I tell you honestly when it stops being worth it.
Yes, that is what the support retainer is for. Adobe’s monthly patches go through the same staging routine after each patch day, and hotfixes for vulnerabilities that are already exploited go first, not into a queue for next month.
Yes. On Adobe Commerce Cloud I check the cloud patches package first, because it may already contain the fix and an isolated patch on top can then fail. On Mage-OS I apply its own security releases, and on B2B the separate B2B patch files in the right order.
Send your store URL, the exact Magento version if you know it, and where the store is hosted. I reply within one business day with what is missing and a fixed price. You talk to the developer, not to a sales team.
