Security updates have always been part of running a Magento store, but the pace of vulnerability discovery is changing.
AI tools can now analyze large codebases, identify suspicious patterns, and automate parts of security research. This doesn't mean software suddenly has more security bugs, but existing problems can be found faster.
The same tools are available to security researchers, software vendors, developers, and attackers.
For Magento store owners, the practical conclusion is simple: security patches should be treated as regular maintenance rather than something that can wait until the next major store upgrade.
Adobe released another Magento security update on August 11, so this is a good time to check the latest patches and the overall security status of your store.
1. Apply the August 2026 Magento security patch
On August 11, 2026, Adobe published security bulletin APSB26-92 for Adobe Commerce and Magento Open Source.
The update addresses several vulnerabilities with severity levels ranging from moderate to critical. Depending on the vulnerability, the potential impact includes privilege escalation, security feature bypass, and arbitrary code execution.
At least two of the critical-rated issues don't require authentication to exploit, so this update should be applied without unnecessary delay.
Adobe's security bulletin:
https://helpx.adobe.com/security/products/magento/apsb26-92.html
Adobe also provides standalone patches for affected Magento versions:
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-40380
Isolated security patches are easier to apply
Adobe now provides isolated security patches for some Magento vulnerabilities. These contain only the changes required to address the relevant security issues.
This means you don't necessarily need to perform a full Magento upgrade every time a new vulnerability is disclosed. A smaller patch can be applied to the existing installation.
For example:
patch -p1 < 247p10-2026-08-001-CE.patchThe exact filename depends on the Magento version and edition. Always use the patch intended for your installation.
These isolated patches are also cumulative: each monthly patch is built on top of the previous one for the same version line. If you're not certain last month's patch was installed, confirm that first. Applying a newer patch on top of a gap can fail to apply cleanly or leave earlier issues unfixed.
There is also one practical issue with Composer-managed Magento installations. Applying a raw .patch file directly to vendor code works, but Composer doesn't track the modification. A later composer update can overwrite it.
If your deployment is Composer-based, keep the patch as part of the deployment process, for example using cweagans/composer-patches or an equivalent mechanism, and keep a record of the isolated patches installed on the store.
After applying the patch, complete the normal Magento deployment process and test the storefront, checkout, Admin, cron jobs, and integrations.
For production stores, test the patch on a development or staging environment first whenever possible.
Isolated patches make urgent fixes easier to deploy, but they don't replace normal Magento upgrades. Stores still need to remain on a supported Magento release.
2. Check whether you applied the July APSB26-73 patch
The August update is also a good reason to check the previous Magento security release.
Adobe published APSB26-73 on July 14, 2026:
https://helpx.adobe.com/security/products/magento/apsb26-73.html
Patch downloads and Adobe's installation information:
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421
If your store wasn't patched in July, don't assume that applying only the newest patch automatically resolves everything covered by previous security releases.
Check the requirements for your exact Magento version and confirm which patches have actually been installed.
The Magento version number alone doesn't necessarily show the complete security state of the installation. Adobe can release additional security fixes between normal Magento releases.
You therefore need to know two things:
- Which Magento version is running?
- Which additional security patches have been applied?
3. Check whether your Magento version is still supported
You can check the installed Magento version from the command line:
bin/magento --versionKeep in mind that this reports the Composer-declared Magento version. It won't change when an isolated security patch is applied.
A store can therefore report a current Magento version while still missing an isolated security patch. Magento version and patch status should be tracked separately.
Adobe's official lifecycle policy shows the support periods for Magento releases:
https://experienceleague.adobe.com/en/docs/commerce-operations/release/planning/lifecycle-policy
One important change this month is that standard support for Magento 2.4.6 ended on August 11, 2026.
Stores still running Magento 2.4.6 should start planning an upgrade to a currently supported Magento version rather than relying on 2.4.6 for future standard security updates.
Adobe also maintains information about security patch releases here:
Security patches allow stores to receive important fixes without immediately adopting all changes included in a larger Magento release. They shouldn't, however, become a permanent replacement for upgrades.
This is particularly important for Magento Open Source because extended-support security patches aren't available in the same way as they are for eligible Adobe Commerce customers.
4. Update third-party Magento extensions
Updating Magento core doesn't automatically make the entire application secure.
A typical Magento installation contains code from many vendors. Extensions can add controllers, REST and GraphQL endpoints, file uploads, Admin functionality, payment integrations, frontend forms, cron processes, and other externally accessible functionality.
An outdated extension can therefore create a vulnerability even when Magento itself is fully patched.
Review the modules installed on the store and check whether updates are available. Pay particular attention to extensions that haven't been maintained for a long time.
If an extension is no longer used, removing it completely is usually preferable to leaving obsolete code on the production server.
The same applies to themes and their bundled modules.
For Swissup products, customers should also keep installed modules and themes reasonably current rather than running old releases indefinitely.
5. Update the server, not only Magento
Magento is only one part of the software stack serving your store.
Depending on the hosting environment, that stack can include:
- Linux
- PHP
- Nginx or Apache
- MySQL or MariaDB
- Redis
- OpenSearch or Elasticsearch
- Varnish
- cPanel, Plesk, or another hosting control panel
All of these components receive their own security updates, independently of Magento.
Recent examples show why this matters. PHP has received several 2026 point releases containing security fixes, including fixes affecting PHP-FPM, OpenSSL functionality, and database drivers. Ubuntu has also released kernel security updates containing fixes for multiple CVEs.
A kernel update is particularly easy to overlook because installing updated packages isn't always enough — the server may need to be rebooted before the new kernel is actually running.
Nginx and system libraries such as curl also receive independent security fixes. Magento uses these components indirectly for normal store operations, including external API requests, payment integrations, shipping services, and webhooks.
This is particularly important on self-managed VPS and dedicated servers, where responsibility for these updates belongs to the server administrator.
cPanel/WHM and database servers such as MariaDB and MySQL also have their own security and maintenance releases. Their installed versions should be checked periodically rather than assuming that updating Magento covers the whole environment.
The installed cPanel version can be checked with:
/usr/local/cpanel/cpanel -VAn update can be triggered with:
/scripts/upcp --forceOn managed Magento hosting, much of the server maintenance is normally handled by the hosting provider. Even then, it is useful to know which PHP, database, search engine, and operating system versions your store uses and whether they remain supported.
A Magento store can be fully patched while still running on outdated server software.
A useful way to think about the complete stack is:
Operating system → PHP → web server → database → Redis/OpenSearch → control panel → Magento → extensions6. Do a quick Magento security configuration check
Applying patches is the priority, but this is also a good opportunity to check some basic security configuration.
Start with Magento Admin accounts. Remove accounts that are no longer required and make sure two-factor authentication is enabled.
Shared administrator accounts should generally be avoided because they make it harder to identify who performed a particular action.
Review SSH access as well. Remove old accounts and keys, restrict access where practical, and avoid password-based root access.
Check that the Magento Admin URL isn't using an obvious default value.
The web server should also be checked for accidentally exposed files. Database dumps, ZIP archives, old Magento installations, log files, Git repositories, and temporary backups should never be publicly downloadable.
Finally, check the backups.
Having an automated backup job doesn't necessarily mean you have a usable backup. Check where backups are stored, how long they are retained, and whether the store can actually be restored from them.
Adobe maintains a broader set of Magento and Adobe Commerce security recommendations here:
Security updates should become routine maintenance
There is no single patch that makes a Magento store permanently secure.
Right now, the immediate priorities are to check the August APSB26-92 patch, confirm that the July APSB26-73 patch wasn't missed, and verify that the Magento version itself is still supported.
The rest of the environment shouldn't be ignored. Extensions and server software have their own security updates and support cycles.
AI-assisted security research is likely to continue making vulnerability discovery faster. Keeping a production Magento installation secure therefore increasingly depends on applying updates regularly rather than waiting for a major upgrade project.
A practical routine is:
Magento patches → extensions → server software → security configuration → repeat.If you haven't checked your Magento installation recently, the August security release is a good reason to do it now.