Adobe patched StyleSmuggler. That is step 1 of 14.
CVE-2026-75650 is fixed, but Adobe’s own remediation list runs to fourteen steps and eight of them are credential rotations. The patch is the easy half.
Blog
Notes on Magento, Adobe Commerce and the parts of eCommerce that break quietly.
StyleSmuggler: what to do while there is no Magento patch
The first shop confirmed backdoored by StyleSmuggler was fully patched. The check to run today, a Cloudflare rule that stops the scanning, and the application guard that actually holds.
Keeping a shop readable by AI assistants
Making a shop readable to AI assistants is about a day of work. Keeping it readable is the actual job, and the defaults are quietly working against you.
A CSP in report-only mode protects nothing
Report-only is a measuring tool, not a control. If nobody reads the reports it is a header that does nothing, and switching it on later is where the real work starts.
What a Magento store actually costs to run
Nobody hands you the full bill in one place. Licence, hosting, extensions, integrations and the maintenance nobody budgets for, and which of them is usually the biggest.
The robots.txt you did not write
Cloudflare rewrites robots.txt at the edge and blocks AI crawlers by default. None of it lives in your repository, so reading the file in git tells you nothing.
B2B buyers do not want your webshop
A customer ordering the same forty products every month is not shopping. Most B2B storefronts are built for discovery, which is the one thing that buyer never needs.
I got the Adobe Commerce licence number wrong
I put a number on Adobe Commerce licensing in public. Two people who deal with those contracts weekly told me it was too high. Here is the better answer, and why the range is so wide.
npm pruned your lockfile to your laptop
CI died on a package nobody had heard of. npm had quietly removed every platform variant except the one my Mac needed, and the fix everybody documents makes it worse.
Four systems and no catalogue
When product data lives in a PIM, an ERP, the shop and a spreadsheet, you do not have a catalogue. You have four opinions, and the import quietly picks a winner.
The checkout failures nobody reports
A checkout that loses an order does not usually throw an error. It succeeds, returns 200, and quietly writes the wrong thing. Two ways I have watched that happen.
The import that exits 0 and imports nothing
Two different ways a product import reports complete success while doing none of the work, and neither of them shows up in the exit code or the job table.
The SOAP client with no timeout
Slow carts, 503s, 524s, and not one error in any log. The integration client was configured to wait forever, and nothing else in the stack was willing to stop it.
You cannot disable a product on one website
A request to hide a product on one of several websites turned out to be unstorable. status and visibility had been changed to global scope, and the import deletes store-scoped values anyway.
Every attribute label says Unknown
Nearly two thousand attributes had the literal admin label "Unknown". The real labels existed the whole time, one table over, and fixing it in the database would have lasted until the next import.
Your foreign keys are not protecting your EAV data
The constraint says ON DELETE CASCADE. Removing nine attributes still left nearly a million orphaned rows, because setup:upgrade turns foreign key checks off.
Two saves, one cart, and one of them is lost
Two API calls fired in parallel, each writing a different field on the same cart. One field kept coming back empty, and the cause is in how Magento builds its UPDATE.
The cache lifetime your config.xml is lying about
A module documented a ten minute price cache. It was really running at twenty four hours, and nothing invalidated it when prices changed.