Magento 2 & Hyvä articles tagged “Nginx”: hands-on tutorials, fixes, and guides from Kishan Savaliya, an Adobe-certified Magento developer.
6 articles
My CloudPanel VPS had ten PHP-FPM versions running, six of them end of life. With the php2shell bugs out, here is how I proved none of them served a request, switched them off with systemctl, and kept a one-line rollback, plus what to do if a Magento store still needs old PHP.
php2shell leaked before the patch, so the first question is not when to update PHP but whether someone already got in. These are the read-only checks I ran on my own Magento VPS: worker processes, access logs, changed files and the Magento database.
php -v shows one PHP, but most servers run several at once: CLI, a PHP-FPM service per version, Docker containers and control panel builds. Here is how I found all of them on my own VPS before the 21 October 2026 PHP security release.
September 2026 brought StyleSmuggler, an unauthenticated Magento RCE that was a live zero-day at disclosure and hits every 2.4.x including 2.4.9, while SessionReaper (CVE-2025-54236) keeps owning unpatched stores a year on. Here is what each attack does and the prioritized playbook to protect your store: web-server mitigation, patching, key rotation, and a compromise hunt.
Adobe shipped its July security fix as an out-of-band .patch file. Mage-OS shipped it as version 3.2.0. Here is what the patch actually fixes, the nginx caveat that bit a store I cleaned up in June, and how to upgrade.
One Magento install can serve any number of brands, regions, and languages, but only if you map the Website, Store, and Store View scopes correctly from the start. This guide walks you through every step: admin creation, nginx virtual host wiring, per-scope CLI config, shared vs separate catalogs, and the common pitfalls that break production multi-store setups.
