Security research

Magento security blog

Technical breakdowns of what actually breaks Magento & Adobe Commerce stores — critical CVEs, card skimmers, and misconfigurations. Root cause, how attackers abuse it, real-world examples, and the exact fix. Sourced from the advisories and research, not marketing.

critical Misconfiguration

Exposed app/etc/env.php: the one file that leaks your entire Magento store

If env.php is downloadable, an attacker has your database password, admin URL, and the encryption key that decrypts customer data. Why it happens, how it is found at scale, and how to lock it down.

Feb 15, 2026 6 min read