Security is Not an Add-on.
It's the foundation of everything we build. Meet Sentinel, our proprietary defense framework.
Magento-aware monitoring spots admin probing, card skimmers and bot floods, and abusive sources are blocked at the server firewall.
Security Monitoring Included
Every plan comes with Sentinel, which spots common OWASP attacks and blocks their sources.
Free SSL
Auto-renewing Let's Encrypt certificates for every domain and subdomain.
Malware Scanning
Daily filesystem scans to detect webshells and injected code.
When a CVE drops, we publish and patch
Security isn't a badge. It's a response time. When vulnerabilities affecting Magento stores are disclosed, we assess them, patch our platform, and publish plain-English guidance for store owners. Recent examples:
- CVE-2026-67401: the cPanel bug that turns a mail user into root
A SQL injection flaw in cPanel's EmailTrack lets an authenticated account with mail privileges create arbitrary files and end with code execution as root. Every supported version of cPanel and WHM was affected. What the advisory says, why shared hosting changes the risk, and the timestamps for our own fleet.
- Securing a Magento store before the November code freeze
Peak season is when rising attack traffic meets a change freeze. Patch order, the credential files that are almost always reachable, admin hardening, and what six thousand daily attack events actually look like across a Magento fleet.
- StyleSmuggler (APSB26-146): Magento and Adobe Commerce remote code execution
Disclosed by Sansec on 5 September 2026 and exploited from 4 September. Adobe released APSB26-146 and hotfix VULN-39341 on 7 September 2026. All versions affected including 2.4.9. Our 7 September sweep of every Magento server we host found no compromised customer store, and one injection attempt that never executed.
- APSB26-92 (CVE-2026-71362): critical unauthenticated Magento account takeover
A CVSS 9.1 incorrect authorization flaw that switches a customer session into another account. Attempts started within days of Adobe's 11 August bulletin and are being blocked, with no confirmed compromises. Application patch staged and coordinated; PHP fixed at the server layer.
- RefluXFS (CVE-2026-64600): XFS local-root flaw that bypasses SELinux
A nine-year-old Linux XFS race gives a local user root on the RHEL-family default that cPanel shared hosting runs on. Single-tenant dedicated bounds the blast radius.
- APSB26-73: July 2026 Adobe Commerce & Magento security update
A CVSS 10.0 unauthenticated RCE in webhooks. Patched fleet-wide; isolated-patch guidance for everyone else.
- GhostLock (CVE-2026-43499): 15-year-old Linux root bug, public exploit
A 97%-reliable root exploit with container escape: why shared-hosting tenants should ask questions this week.
- Bad Epoll (CVE-2026-46242): unprivileged-to-root via the epoll subsystem
A race condition in the machinery under nginx and PHP-FPM. Kernels 5.10–6.11 affected.
- Januscape (CVE-2026-53359): KVM guest-to-host escape
A neighbour's VPS can become root on the host under your store, and only the host provider can patch it.
- CVE-2026-12184 & CVE-2026-14355: PHP DoS flaws in every Magento PHP line
A failed TLS handshake can crash a PHP-FPM pool. Fixed in PHP 8.2.32 / 8.3.32 / 8.4.23 / 8.5.8.
- APSB26-49: Adobe Commerce & Magento security patches, May 2026
What the critical patches mean and what UK merchants need to do.
- Fragnesia (CVE-2026-46300): Linux kernel privilege escalation
How a webshell becomes root, and how our platform was patched.
- CVE-2026-45247: Mirasvit Cache Warmer remote code execution
A popular Magento extension turned attack vector: detection and mitigation.
- CVE-2026-23111: why shared hosting multiplies kernel exploits
One compromised tenant shouldn't mean every store on the box is exposed.
Security included on every plan
- ✓ Sentinel security monitoring tuned for Magento attack patterns
- ✓ Daily malware & webshell scanning
- ✓ On-server backups (retention depends on disk), plus the Bastion encrypted off-site vault as an add-on
- ✓ Staging environment for safe changes
- ✓ Auto-renewing SSL on every domain
- ✓ Sentinel skimmer & webshell detection
- ✓ Proactive patching of stack CVEs
- ✓ 24/7 UK engineers on call