Security is Not an Add-on.

When a CVE drops, we publish and patch

Security isn't a badge. It's a response time. When vulnerabilities affecting Magento stores are disclosed, we assess them, patch our platform, and publish plain-English guidance for store owners. Recent examples:

• CVE-2026-67401: the cPanel bug that turns a mail user into root

  A SQL injection flaw in cPanel's EmailTrack lets an authenticated account with mail privileges create arbitrary files and end with code execution as root. Every supported version of cPanel and WHM was affected. What the advisory says, why shared hosting changes the risk, and the timestamps for our own fleet.

• Securing a Magento store before the November code freeze

  Peak season is when rising attack traffic meets a change freeze. Patch order, the credential files that are almost always reachable, admin hardening, and what six thousand daily attack events actually look like across a Magento fleet.

• StyleSmuggler: unpatched Magento and Adobe Commerce remote code execution

  Disclosed by Sansec on 5 September 2026, exploited from 4 September, with no Adobe advisory, CVE or patch at time of writing. All versions affected including 2.4.9. We swept every Magento server we host: no customer store was compromised, and one injection attempt was found that never executed.

• APSB26-92 (CVE-2026-71362): critical unauthenticated Magento account takeover

  A CVSS 9.1 incorrect authorization flaw that switches a customer session into another account. Attempts started within days of Adobe's 11 August bulletin and are being blocked, with no confirmed compromises. Application patch staged and coordinated; PHP fixed at the server layer.

• RefluXFS (CVE-2026-64600): XFS local-root flaw that bypasses SELinux

  A nine-year-old Linux XFS race gives a local user root on the RHEL-family default that cPanel shared hosting runs on. Single-tenant dedicated bounds the blast radius.

• APSB26-73: July 2026 Adobe Commerce & Magento security update

  A CVSS 10.0 unauthenticated RCE in webhooks. Patched fleet-wide; isolated-patch guidance for everyone else.

• GhostLock (CVE-2026-43499): 15-year-old Linux root bug, public exploit

  A 97%-reliable root exploit with container escape: why shared-hosting tenants should ask questions this week.

• Bad Epoll (CVE-2026-46242): unprivileged-to-root via the epoll subsystem

  A race condition in the machinery under nginx and PHP-FPM. Kernels 5.10–6.11 affected.

• Januscape (CVE-2026-53359): KVM guest-to-host escape

  A neighbour's VPS can become root on the host under your store, and only the host provider can patch it.

• CVE-2026-12184 & CVE-2026-14355: PHP DoS flaws in every Magento PHP line

  A failed TLS handshake can crash a PHP-FPM pool. Fixed in PHP 8.2.32 / 8.3.32 / 8.4.23 / 8.5.8.

• APSB26-49: Adobe Commerce & Magento security patches, May 2026

  What the critical patches mean and what UK merchants need to do.

• Fragnesia (CVE-2026-46300): Linux kernel privilege escalation

  How a webshell becomes root, and how our platform was patched.

• CVE-2026-45247: Mirasvit Cache Warmer remote code execution

  A popular Magento extension turned attack vector: detection and mitigation.

• CVE-2026-23111: why shared hosting multiplies kernel exploits

  One compromised tenant shouldn't mean every store on the box is exposed.

All security guidance in Insights →