Cloudflare accidentally took half the internet down for half a day, right before Black Friday. What can we learn from this, and how can we engineer more resilient infrastructure to survive similar outages in the future?
Session Reaper (CVE-2025-54236) is the latest major security vulnerability that offers unauthenticated RCE in the Magento ecosystem. Originally reported and patches supplied a month or two ago. But in the last few days, we have seen attacks start to begin targeting this vulnerabilities. As public POC & technical writes up started to be published. From my understanding, you are at risk if the following applies: Has not applied the latest patch releases Has not manually applied the Session Reaper patch Uses File System Session Storage (NOT Redis) Not using SanSec Shield WAF (Cloudflare block some attempts - not all) Some good writeup’s on this topic are: ...
Deploying patches is simple for in-house development teams or smaller Agencies maintaining only a few stores. Manually applying patches per project is simple, but doesn’t scale well. Both from time cost and security exposure perspectives. If your optimistic and confident in your monitoring setup, patching can be less than a few hours of engineering time. Live Patching Live patching is reserved for high severity security related patches (think CosmicSting, SessionReaper), that need to be released to production ASAP. Where we will typically skip the usual deployment/testing process and patch the current deployments. ...
Terraform offers the -plan flag and Ansible offers the --check flag. But what does Magentos DB Schema offer? It can be very frustrating, when you have unexpected schema changes occur. And as far as I can tell, there is no core way to visualise the changes. Last year I wrote about the time I had this exact issue, and how I went about identify what DB schema was trying todo. You can read that here, but the script is out of date now: http://www.sdj.pw/posts/magento2-db-schema-diff/ ...
In Short: Its very cost effective, we are seeing savings between £2500 and £3500 per month, over hosted estimates. Its been very stable (a setup and forget type situation) Updates are released fairly frequently, and are simple to apply Be very mindful of free disk space, it runs postgres which can massive pain to clean up when close to limits. Sentry’s disk clean up functionality seems to be flaky The CSP functionality gets the job done Cost Cost is the leading factor to self hosting sentry for us, and its a win win scenario. As it becomes much more affordable for clients to opt for, and we get observability into the frontend health & metrics of the stores. ...
Heading into Black Friday, cache hit rates are a metric to monitor closely. Having poor cache performance, is likely to see dramatic increases in page load speed, higher autoscaling infrastructure costs, or even worse. 500 series errors. As part of our pre-emptive precautions, we have built an experimental module which intercepts and defers Varnish cache purges to a set schedule. We’ve rolled it out to some of the stores with problematic ERP systems and problematic store admins… Hopefully we can leave it disabled the entire time, but its a nice piece of mind. ...
I hear the claim of 100% uptime thrown around a lot. Although is 100% uptime really a good goal to have? Like most things in tech, the answer is, it depends. If your running your Magento store within a fault tolerant cluster, sure 100% website uptime is a good goal. Whereas if your are running Magento on a single instance, or even multiple servers but not in a cluster. Then claiming to aim for 100% uptime is more of a red flag than something to be proud of. ...
🔥 Hot Take: Stop offloading poor engineering practises onto clients. There is no wonder merchants are apprehensive about using Magento 2, when we are quoting them excessive amounts to even keep their store up to date and secure. In some recent research, I’ve seen estimates in excess of 100 hours for an update. That seems wild to me! I’ve found Magento releases have been getting a lot more stable & bug free in recent years, especially since Adobes acquisition. At least in comparison with the early Magento 2 / Magento 1 days. We used to have “SUPEE-xxx potential issues?” threads popping up on stack exchange before the updates even dropped. ...
Chaos. Those who know me, knows that I love a bit of chaos in my work. Data center caught fire? Server fell out the rack? Its like a free roller coaster. For someone who’s role is to reduce the chaos, I enjoy and thrive on it a little bit too much. Why implement Chaos Engineering practises? This is where Chaos Engineering comes into play, nobody wants to be woken up at 3am because OOMKiller has decided your database is not important any more. Although scrambling over that notification at 9:32am on a Thursday morning is a lot more fun. (Especially when you are expecting potential issues during that time). ...
The default Nginx sample configuration, and htaccess files shipped by Magento have the /setup/ route publicly accessible. And this route displays your current magento version, including patch level. For all prying eyes to see. Currently this affects all Magento versions up to 2.4.7-p1 (the latest at time of writing), including 2.4-develop. It is worth noting, I believe the web installed was removed in 2.4. Is there any need for this route to continue to exist, apart from leaking version data? ...