Posts

Sansec provides the gold standard for Magento 2 malware detection and security monitoring through its product Ecomscan. It offers comprehensive protection for Magento stores, including vulnerability scanning, malware detection, and real-time threat intelligence. Most merchants and agencies rely only on Ecomscan running on their infrastructure to monitor live stores. However, far fewer teams take advantage of Ecomscan’s ability to be integrated into CI/CD pipelines. Where it can catch issues before they ever reach production. Integrating Ecomscan into your artifact security scanning pipelines ensures that no malicious code, supply-chain malware, or missing security patches make it into your deployable builds. ...

I rebuilt small projects to test AI for frontend, SEO and UI. Here’s what helped, what broke, and how I’d use it again.

Cloudflare accidentally took half the internet down for half a day, right before Black Friday. What can we learn from this, and how can we engineer more resilient infrastructure to survive similar outages in the future?

Session Reaper (CVE-2025-54236) is the latest major security vulnerability that offers unauthenticated RCE in the Magento ecosystem. Originally reported and patches supplied a month or two ago. But in the last few days, we have seen attacks start to begin targeting this vulnerabilities. As public POC & technical writes up started to be published. From my understanding, you are at risk if the following applies: Has not applied the latest patch releases Has not manually applied the Session Reaper patch Uses File System Session Storage (NOT Redis) Not using SanSec Shield WAF (Cloudflare block some attempts - not all) Some good writeup’s on this topic are: ...

Deploying patches is simple for in-house development teams or smaller Agencies maintaining only a few stores. Manually applying patches per project is simple, but doesn’t scale well. Both from time cost and security exposure perspectives. If your optimistic and confident in your monitoring setup, patching can be less than a few hours of engineering time. Live Patching Live patching is reserved for high severity security related patches (think CosmicSting, SessionReaper), that need to be released to production ASAP. Where we will typically skip the usual deployment/testing process and patch the current deployments. ...

Terraform offers the -plan flag and Ansible offers the --check flag. But what does Magentos DB Schema offer? It can be very frustrating, when you have unexpected schema changes occur. And as far as I can tell, there is no core way to visualise the changes. Last year I wrote about the time I had this exact issue, and how I went about identify what DB schema was trying todo. You can read that here, but the script is out of date now: http://www.sdj.pw/posts/magento2-db-schema-diff/ ...

In Short: Its very cost effective, we are seeing savings between £2500 and £3500 per month, over hosted estimates. Its been very stable (a setup and forget type situation) Updates are released fairly frequently, and are simple to apply Be very mindful of free disk space, it runs postgres which can massive pain to clean up when close to limits. Sentry’s disk clean up functionality seems to be flaky The CSP functionality gets the job done Cost Cost is the leading factor to self hosting sentry for us, and its a win win scenario. As it becomes much more affordable for clients to opt for, and we get observability into the frontend health & metrics of the stores. ...

Heading into Black Friday, cache hit rates are a metric to monitor closely. Having poor cache performance, is likely to see dramatic increases in page load speed, higher autoscaling infrastructure costs, or even worse. 500 series errors. As part of our pre-emptive precautions, we have built an experimental module which intercepts and defers Varnish cache purges to a set schedule. We’ve rolled it out to some of the stores with problematic ERP systems and problematic store admins… Hopefully we can leave it disabled the entire time, but its a nice piece of mind. ...

I hear the claim of 100% uptime thrown around a lot. Although is 100% uptime really a good goal to have? Like most things in tech, the answer is, it depends. If your running your Magento store within a fault tolerant cluster, sure 100% website uptime is a good goal. Whereas if your are running Magento on a single instance, or even multiple servers but not in a cluster. Then claiming to aim for 100% uptime is more of a red flag than something to be proud of. ...

🔥 Hot Take: Stop offloading poor engineering practises onto clients. There is no wonder merchants are apprehensive about using Magento 2, when we are quoting them excessive amounts to even keep their store up to date and secure. In some recent research, I’ve seen estimates in excess of 100 hours for an update. That seems wild to me! I’ve found Magento releases have been getting a lot more stable & bug free in recent years, especially since Adobes acquisition. At least in comparison with the early Magento 2 / Magento 1 days. We used to have “SUPEE-xxx potential issues?” threads popping up on stack exchange before the updates even dropped. ...