Every Adobe security release read the day it lands, tested on staging and deployed inside a window you agreed.
A monthly retainer for Magento Open Source, Adobe Commerce and Mage-OS stores: security releases tested and deployed within an agreed window, monitoring an engineer reads, a hardened edge and incident response. For merchants who want one team answerable for the store's security. Priced as a set monthly figure, agreed once we have examined the store.
What merchants tell us in the first call, in their words.
Adobe published another security bulletin and nobody has told us whether it affects us.
Patches wait until someone remembers. Once a fix is public, so is the weakness it fixes.
We are on 2.4.6 and the agency says it is fine for now.
On Magento Open Source, the last 2.4.6 fix shipped on 11th August 2026. Adobe's September bulletin lists 2.4.6 as affected with no fix for it, so fixes now have to be backported.
Our developer only looks at the store when we raise a ticket.
Nobody is watching for the quiet signs: a new admin user, an unexpected scheduled task, pages appearing in Google that you never published.
Six things, done every month, with a written record of each.
Every Adobe bulletin read on the day, tested on staging, deployed in the window, backported where needed.
File changes, admin and API activity, new scheduled tasks and pages you did not publish, read by an engineer.
Firewall rules tuned to Magento, rate limits on the endpoints attackers target, and a locked-down admin path.
Isolate, find the entry point, clean, rotate credentials, patch and write it up. Included for retained stores.
Admin accounts reviewed, two-factor enforced, API tokens audited, PHP kept in support, backups test-restored.
What was patched, what was seen, what changed and what we recommend next, on one page.
The same sequence for every store and every Adobe bulletin, so nothing depends on who is on holiday.
Send us the store address. A senior engineer reads its release, support status, PHP, headers, hosting and any sign of a hijack.
Within two working daysRelease, patch level, modules, hosting, edge and who can reach the admin, read from the inside.
Before the retainer startsThe store brought to its latest available patch level, admin access locked down, two-factor enforced, edge rules and monitoring enabled.
The first weeksRead on the day Adobe publishes it, matched to your release and modules, tested on staging along the money paths, deployed at a quiet hour with a rollback ready.
Each Adobe security releaseWhat was patched, what the monitoring saw, what changed and what we recommend next.
MonthlyWhat we found on the UK web in 2026, and Adobe's own bulletins.
UK Magento stores already hijacked and serving spam pages, almost all on unsupported releases, when we looked in October 2026.
live .co.uk stores still on Magento 1, which Adobe stopped supporting in June 2020. How we move them.
the last Magento Open Source fix for 2.4.6, in Adobe bulletin APSB26-92. Standard support ended the same day.
when regular support for 2.4.7 ends, per Adobe's released versions page. Plan the upgrade this year.
Security update ships for Open Source 2.4.6, 2.4.7, 2.4.8 and 2.4.9. Standard support for 2.4.6 ends the same day.
2.4.6 fixedA critical flaw (CVE-2026-75650, CVSS 10.0) that Adobe says is being exploited in the wild, needing no login. Fixed by a hotfix.
exploitedLists Open Source 2.4.6 as affected, and publishes updated versions only for 2.4.7, 2.4.8 and 2.4.9.
2.4.6 not fixedRead from Adobe's security bulletins and lifecycle pages on 31st October 2026. Adobe Commerce customers on 2.4.6 have extended support to 31st August 2027.
If the store is compromised today, call us now rather than reading on: 020 8058 5072.
We price the work, not the clock.
A security retainer is a set monthly figure, agreed once we have examined the store: its release, hosting, integrations and traffic decide the work, so we look first and then put a figure in writing. Development you ask for on top is itemised on the same monthly invoice.
A Magento store on Hyvä trading into Ireland, Northern Ireland and Great Britain, kept patched and fast.
Core Web Vitals, real-user data (Chrome UX Report), mobile, 28 days to 31st October 2026. Marks show Google's thresholds.
… Security was a top priority for us and he answered all our questions and is always on hand when updates are urgent. …
Decades of collective experience across Magento 1, Magento 2, Adobe Commerce, Hyvä and Shopify. Very little about your store will be new to us.
You deal directly with the founder. No juniors learning on your store and no account managers between you and the people doing the work.
Small stores and large ones, described in their owners' words. The reviews are quoted on this site word for word.
No, and nobody honest can. What we can do is remove the conditions that almost every UK Magento compromise we have seen depends on: an unsupported release, a missing security patch, exposed admin and API surfaces, and nobody watching. In October 2026 we found 722 UK Magento stores already hijacked and serving spam pages, almost all of them on unsupported releases.
Yes. Adobe stops shipping fixes for unsupported releases, so we backport the relevant security patches ourselves, harden the edge in front of the store, and put the upgrade on a dated plan. Cover on an unsupported release is a bridge, not a destination, and we say so in the proposal. The same applies to Magento 1, which we also keep patched while a move to Magento 2 is planned.
We read the advisory the day it lands, decide whether it touches your store, test the patch on staging and deploy it to live within the window agreed with you, usually inside a few working days. You get a written note of what was applied and when.
Tell us straight away. Incident response is part of the retainer and available as a one-off: we isolate, find the entry point, clean, rotate credentials, patch what let it in, and write it up for you, your payment provider and, where needed, the ICO.
For the retainer, yes: deployment access to staging and live, read access to logs, and an admin account. The free health check needs none of that; it reads only what the store already serves publicly.
It is built for Magento Open Source, Adobe Commerce and Mage-OS. Shopify patches its own platform, so Shopify stores have a different risk profile and are covered under Shopify support.
A set monthly figure, agreed once we have examined the store: its release, hosting, integrations and traffic decide the work. Subscriptions to third-party security services, where you want them, are shown separately. The first look and the proposal are free.
Those are tools, and good ones; we use them. The retainer is the people who act on what the tools report: reading each Adobe bulletin, testing and deploying the patch, investigating an alert and responding when something happens.
Give us the address and we will read what the store already shows the world: release, support status, PHP, headers, hosting and any sign of a hijack. One page, by email, within two working days. Nothing is accessed or tested.
What we would do first. Apply the outstanding security fixes, then plan the upgrade to a supported release.