Kishan Savaliya
Latest posts
-
Upgrades & Patches
Magento 2.4.9
php2shell (CVE-2026-109618, CVE-2026-109619): What the October 2026 PHP Security Release Fixes and What to Do
The October 2026 PHP security update fixes php2shell, two critical bugs that can allow unauthenticated remote code execution. Here is what they are, who is at risk, how to update on common setups, and what to do on PHP 8.1 and older.
Read article -
Upgrades & Patches
DevOps
Patching PHP in Docker: How to Update PHP in a Docker Container After php2shell
Running Magento, WordPress or any PHP app in Docker? The php2shell security release will not reach your containers through the host. Here is how I update PHP in a Docker container: pull or rebuild, recreate, verify php -v, and close dev ports on the LAN.
Read article -
Upgrades & Patches
DevOps
End-of-Life PHP on a Magento Server: Find It, Prove Nothing Uses It, Turn It Off
My CloudPanel VPS had ten PHP-FPM versions running, six of them end of life. With the php2shell bugs out, here is how I proved none of them served a request, switched them off with systemctl, and kept a one-line rollback, plus what to do if a Magento store still needs old PHP.
Read article -
Upgrades & Patches
Audit
Was My Magento Server Hacked? How to Check for PHP Remote Code Execution
php2shell leaked before the patch, so the first question is not when to update PHP but whether someone already got in. These are the read-only checks I ran on my own Magento VPS: worker processes, access logs, changed files and the Magento database.
Read article -
Upgrades & Patches
CLI
How to Find Every PHP Version Running on Your Server (Before You Patch)
php -v shows one PHP, but most servers run several at once: CLI, a PHP-FPM service per version, Docker containers and control panel builds. Here is how I found all of them on my own VPS before the 21 October 2026 PHP security release.
Read article -
Upgrades & Patches
Magento 2.4.9
How to Check Missing Magento Security Patches on 2.4.9: A 7-Step Checklist
bin/magento --version says 2.4.9 whether your store has every 2026 isolated patch or none. This checklist shows how to check missing Magento security patches with vendor/bin/patch-status, per-patch dry runs that understand stacking, a CI gate, and a monthly routine.
Read article -
Upgrades & Patches
Magento 2.4.9
Magento Isolated Patch Not Applying? How I Fixed the October 2026 Patch on My Own Store
The October 2026 Magento isolated patch failed on two files on my own 2.4.9 store. The causes: two skipped monthly patches, an old hand edit in vendor, and a Composer hook that broke once patches stacked. Real output, the fix order, and the hook logic that now works.
Read article -
Upgrades & Patches
Magento 2.4.9
Magento APSB26-153 (October 2026 Security Patch): What It Fixes and How to Apply It
APSB26-153 is the October 2026 Magento security patch from Adobe: 11 CVEs, five critical, topped by an unauthenticated CVSS 10.0 template engine flaw. Here is who is affected, what the 2.4.9 CE patch changes, and the exact steps I use to apply 249-2026-10-001-CE.patch on Magento Open Source.
Read article -
Magento Development
Magento 2.4.9
Magento 2 "Unable to Unserialize Value. Error: Syntax Error": The Complete Fix
The Magento 2 "Unable to unserialize value. Error: Syntax error" almost always means an old PHP serialize() value is sitting where Magento now expects JSON, usually after an upgrade or a mismatched database restore. This guide fixes it fix-first for 2.4.4 to 2.4.9: flush the cache, read the stack trace to find the table, then convert or clear the one bad row safely.
Read article -
Magento Development
Magento 2.4.9
Magento 2 Product Images Not Showing: The Complete Fix
Grey placeholders, broken thumbnails, or 404s under /media/catalog/product/cache/ have a short, fixable list of causes. This guide works through each one fix-first for Magento 2.4.4 to 2.4.9: regenerating the resized cache, the 660 permission trap after a migration, missing originals, base media URL, CDN cached 404s, and wrong store-view or image roles.
Read article
