hryvinskyi

APSB26-153 (October 2026) Security Patch: backport for Magento Open Source 2.4.6

Problem

APSB26-153 (13 October 2026) fixes 11 CVEs in Adobe Commerce and Magento Open Source, five of them critical. The most serious is CVE-2026-103849, a template engine injection rated CVSS 10 that needs no login.

Adobe lists Open Source 2.4.6 as affected but ships the fix for Open Source only from 2.4.7 onwards. Standard support for 2.4.6 ended on 11 August 2026, and the 2.4.6 isolated patch (2-4-6-p15-oct-2026.zip) can only be downloaded with an Adobe Commerce entitlement.

This gist is Adobe's 2.4.7-p10 Open Source patch (247p10-2026-10-001-CE) ported to 2.4.6-p15 and split per Composer package for cweagans/composer-patches.

hryvinskyi

CSP SRI sri-hashes.json Atomic Write Patch (Magento 2.4.8-p5)

Overview

This patch addresses two issues in Magento's Content Security Policy (CSP) module on Magento 2.4.8-p5 (magento/module-csp 100.4.7-p3):

1. Race condition: Fixes corrupted sri-hashes.json files caused by concurrent writes, which produce malformed JSON and 500 errors on checkout.
2. Minification support: Ensures static.min.js / mixins.min.js are loaded and their SRI

hryvinskyi

Fix File Custom Option Processing via REST/SOAP API

Backport of mage-os/mageos-magento2#210 for Magento 2.

Problem

File-type custom options cannot be submitted through the REST/SOAP API when adding products to cart. The CustomOptionProcessor does not handle file_info data from API requests, and there is no validation to prevent file uploads on non-file option types.

What the Patch Does

hryvinskyi

#!/bin/bash

# Order Monitor Script
# Checks if orders have been received within the last 2 hours
# Runs only between 9am and 9pm (7am + 2 hour check period)
# Sends email alerts to specified addresses if no orders found
#
# Usage:
#   ./order-monitor.sh [OPTIONS]
#

hryvinskyi

CSP Storage File Locking Patch

Overview

This patch addresses two critical issues in Magento's Content Security Policy (CSP) module:

1. Race Condition: Fixes corrupted sri-hashes.json files caused by concurrent write operations during normal storefront operation, which results in malformed JSON and 500 checkout errors.

2. Minification Support: Ensures that static.min.js and mixins.min.js are correctly loaded and their SRI hashes properly recorded when CSP and SRI are enabled along with JS bundling and minification enabled simultaneously.

Problems

hryvinskyi

CVE-2025-54236 (SessionReaper) Security Patch

Problem

CVE-2025-54236 (SessionReaper) is a critical unauthenticated Remote Code Execution vulnerability (CVSS 9.1) affecting Magento 2 / Adobe Commerce.

• Attack Vector: /customer/address_file/upload endpoint
• Impact: Unauthenticated RCE via Phar deserialization

What the Patch Does