Security research
Technical breakdowns of what breaks Magento & Adobe Commerce stores: critical CVEs, card skimmers and misconfigurations. Root cause, how attackers abuse it, real-world examples, and the exact fix. Sourced from the advisories and research, not marketing.
Magento_Csp ships most storefront pages in report-only mode, which enforces nothing. This is how report-only and restrict actually differ, why an over-broad whitelist still lets skimmers run, and the exact sequence to tune csp_whitelist.xml and flip to restrict without breaking checkout.
5 min read
The default /admin frontName, disabled 2FA, an admin URL shared with the storefront, and no source-IP restriction form one attack surface. How admin credential attacks work, why mandatory 2FA arrived in 2.4.0, and the exact env.php, CLI, and nginx changes that close each gap.
5 min read
Per-account lockout stops brute force but not credential stuffing, where one attempt per account across thousands of accounts evades every counter Magento ships. How the two attacks differ, and the layered Admin, reCAPTCHA, and edge-rate-limiting controls that actually hold.
5 min read
Magento's /graphql endpoint answers introspection in production and rides on webonyx/graphql-php, whose OverlappingFieldsCanBeMerged validator can degrade to quadratic time: a single crafted inline-fragment query can burn a php-fpm worker before any resolver runs. The mechanism, how to detect it, and the isolated patch chain.
6 min read