FIELD NOTES
Engineering notes
Architecture, DevOps and lessons from running eCommerce platforms in production.
PHP’s October 2026 security release: update, restart, verify
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two CVSS 9.2 remote code execution flaws. How to find every PHP runtime, update it properly and…
Adobe Commerce security patches, September to October 2026
Three Adobe Commerce security releases, an exploited zero-day and a critical PHP update in six weeks: what to apply, in what order, and how…
BlockStrap and APSB26-153: check your patch actually applied
October’s CVSS 10.0 template-engine flaw bypassed the September fix. What APSB26-153 contains, and why verifying the deployed code matters more than a green pipeline.
StyleSmuggler: responding to a Magento zero-day
CVE-2026-75650 was exploited for three days before a fix existed. Edge rules, hardening, the hotfix, hunting for compromise and rotating secrets: the response in…
Root cause or band-aid?
Every production issue offers a quick fix and a real one. The questions I ask before fixing anything, when a quick fix is the…
A Git workflow for teams that look after many codebases
Ticket-named branches, ticket keys in commits, separate support and project work, pull requests only, and releases named after release tickets rather than dates.
Enforce code quality before review with GrumPHP
Formatting and coding-standard checks belong to a machine. Setting up GrumPHP with the Magento coding standard, rolling it out sensibly, and backing it up…
What an AWS cost audit usually finds
It is rarely the server size. End-of-life support surcharges, forgotten resources, oversized staging, environments that share production data and old instance generations.
Optimising Magento 2 Performance on AWS
Where Magento 2 performance actually comes from on AWS: caching layers, right-sized data services, indexers and the measurements that tell you what to fix…