Blog

71 posts

11 Sept 2026

Dependency supply-chain and CVE patching in Magento 2

How a Magento store's real attack surface is its dependency tree, how to track CVEs, patch safely, and avoid the two failures that leave stores exposed for months.

magento2securitydependenciescve

10 Sept 2026

Two-factor auth and admin access hardening in Magento 2

How to enforce 2FA on every admin account, lock down access by IP and role, rotate provider keys, and the admin-hardening steps that stop the most common breach path.

magento2securityadmin2fa

09 Sept 2026

Content Security Policy and subresource integrity in Magento 2

How to roll out a Content Security Policy in Magento 2 without breaking the storefront, wire subresource integrity for third-party scripts, and the mistakes that make CSP cosmetic.

magento2securitycspfrontend

08 Sept 2026

StyleSmuggler: the Magento 2 / Adobe Commerce 0-day RCE (CVE-2026-75650)

A detailed breakdown of StyleSmuggler — an unauthenticated CVSS 10.0 RCE affecting every Magento Open Source and Adobe Commerce 2.4.4–2.4.9 — how it reaches live stores, and a step-by-step hardening and incident-response plan.

magento2securityrcezerodayhardening

08 Sept 2026

Hyva performance hardening: CSP, FPC, and measurement

The performance work that follows a Hyva migration — consolidating CSP, using Hyva base-layout resets, keeping full-page cache correct, and measuring the before/after so the gains are provable.

magento2hyvafrontendperformance

07 Sept 2026

Hyva React components and the GraphQL storefront

How to build custom React components on top of Hyva using the Magento GraphQL API — when it helps, how it differs from Alpine/Tailwind, and how to keep it inside the Hyva theme.

magento2hyvafrontendreactgraphql

06 Sept 2026

Hyva Checkout: the React-based checkout

What Hyva Checkout changes from the Luma one-page checkout, the React/Magewire architecture, and the real failure modes teams hit — navigator resets, guest rules, and FPC vs JS dependencies.

magento2hyvafrontendcheckout

06 Sept 2026

Case study: full-page cache broke the category page's JavaScript

A production Hyva storefront loaded fine on the first hit and broke on the second. The culprit was FPC caching a fragment without the JS blocks it depended on.

magento2hyvaperformancefpc

05 Sept 2026

The Luma to Hyva migration checklist

A step-by-step Luma to Hyva migration plan from real storefront cutovers: inventory, theme rebuild, compatibility modules, checkout, CSP, and a go-live checklist that de-risks the cutover.

magento2hyvafrontendmigration

04 Sept 2026

Hyva compatibility modules for third-party extensions

A real-world look at the Hyva compatibility layer: which kinds of Luma-only extensions need a Hyva template, how to structure a compat module, and the extension categories that generate the most migration work.

magento2hyvafrontendmodules

04 Sept 2026

Case study: a social-login widget that ignored its own config

A Hyva + Alpine social-login module rendered the wrong buttons, dropped hidden ones, and tripped CSP. The fix was Alpine reactivity, not security policy.

magento2hyvafrontendcspalpine

03 Sept 2026

Hyva view models: moving logic to PHP

How Hyva view models keep display logic in testable PHP instead of the browser — what they replace from Knockout, how to write one, and when to reach for them.

magento2hyvafrontendphp