APSB Security Bulletins

We monitor every Adobe security release and deploy patches before attackers can exploit known vulnerabilities.

Magecart & Skimming

We detect and prevent JavaScript-based card skimmers that inject malicious code into checkout pages to steal payment details.

Brute Force Attacks

Rate limiting and intelligent blocking stop automated bots targeting admin panels and customer accounts.

Known Vulnerabilities

Unpatched installations and outdated extensions create exploitable entry points. Still on Magento 1? Migration to Magento 2 is the most important security step you can take.

Payment Data Theft

We enforce secure payment handling and encryption best practices to protect stored payment information and transactions.

Data Breaches

Comprehensive access controls, monitoring, and data protection measures prevent customer data leaks and regulatory penalties.

Proactive Patching

We monitor Adobe security releases and deploy patches to your store within hours, not days. Every patch is tested before deployment to ensure zero disruption.

24/7 Monitoring

Automated monitoring using Sentry and New Relic to detect suspicious activity, unauthorised file changes, and performance anomalies. Our scanning runs continuously, checking for known vulnerability signatures, outdated components, and configuration weaknesses, not just waiting for something to break.

Security Audits

Hands-on security assessments covering core file integrity, extension vulnerabilities, admin access controls, server configuration, and PCI compliance. You receive a prioritised report with remediation steps.

Hack Recovery

If the worst happens, we provide rapid incident response to identify the breach, remove malicious code, close the vulnerability, and restore your store.

PCI DSS Compliance

We help you meet PCI DSS requirements for handling payment card data, ensuring your Magento store meets the security standards required by payment processors.

WAF & Hardening

Web application firewall configuration and server hardening to block malicious traffic, prevent common attack vectors, and reduce your store's attack surface.

  1. Containment: We isolate the compromised store to prevent further damage, take forensic backups, and assess the scope of the breach.
  2. Identification: Full file integrity scan against known clean Magento core files. We locate injected code, backdoors, web shells, and any modified files.
  3. Removal & Cleanup: All malicious code is removed, compromised files are restored to clean versions, and any unauthorised admin accounts or database entries are purged.
  4. Hardening: The vulnerability that allowed the breach is patched. Admin credentials are rotated, file permissions are locked down, and additional security layers are applied.

Automated Patch Detection

We continuously monitor Adobe security bulletins and vulnerability databases. When a new patch is released, our systems detect it within hours and alert our team to begin the deployment process immediately.

  • Patches detected within hours of release

Rigorous Testing

Every security patch is deployed to a staging environment first, where it undergoes automated checkout testing and full regression testing. We verify that the patch resolves the vulnerability without introducing new issues.

  • Automated checkout and regression testing

Safe Deployment

Once testing is complete, we deploy the patch to production using our zero-downtime deployment pipeline. Full rollback capability means that if anything unexpected occurs, we can instantly revert to the previous version.

  • Zero-downtime with full rollback capability

Adobe publishes Magento security advisories under the APSB naming convention (Adobe Product Security Bulletin). We monitor every release and apply patches to supported client stores within 2 hours. A full Magento security audit will also flag any stores running on vulnerable versions.

Recent critical advisories:

  • APSB26-05 (March 2026): PolyShell unauthenticated remote code execution affecting all Magento 2 versions up to 2.4.9-alpha2. 15,000 hostnames were compromised in a defacement campaign. Patch available, and we have applied it across all retainer clients.

Patch & Version Status

  • All Adobe APSB security patches applied within SLA
  • Magento version on a supported release line (2.4.6 LTS or later)
  • PHP version on a supported release (8.2 or 8.3)
  • Database engine on a supported MySQL/MariaDB version

Admin & Access Control

  • Custom admin URL, not /admin or /backend
  • 2FA enforced on every admin user
  • Admin user list reviewed quarterly, dormant accounts removed
  • Role-based access control matched to actual job function

Headers & Transport

  • HTTPS enforced site-wide with HSTS preload
  • Content Security Policy in enforce mode, not report-only
  • X-Frame-Options, X-Content-Type-Options, Referrer-Policy set
  • TLS 1.2 minimum, modern cipher suites only

Extensions & Code

  • All third-party extensions on supported versions
  • Composer dependencies audited for known CVEs
  • No core file modifications (file integrity baseline clean)
  • Custom code reviewed for SQL injection, XSS, RCE patterns

Monitoring & Detection

  • WAF in front of the storefront, ruleset tuned for Magento
  • Daily malware and skimmer scans
  • Failed-login alerting on the admin panel
  • File integrity monitoring with alerting on unexpected changes

Backup & Recovery

  • Daily off-site backups of code, database and media
  • Documented and tested restore procedure
  • 30-day point-in-time recovery available
  • PCI-DSS-aligned retention and access controls

Critical & Pre-Auth RCE

Under 2 hours from Adobe release to deployment on retainer stores. Examples: APSB26-05 (PolyShell RCE), APSB22-12 (CosmicSting). Out-of-hours response covered.

High Severity

Within 1 business day for high-severity but non-pre-auth issues. Tested on staging, deployed via the standard CI/CD pipeline with rollback ready.

Medium & Low

Within the next scheduled deployment window. Bundled with the next regular release to avoid unnecessary maintenance overhead, with notification to the merchant in advance.

Christian Andersson

Director, Tieroom

How quickly do you deploy security patches?

We deploy Adobe security patches within hours of release. Every patch is tested in a staging environment first to ensure it doesn't affect your store's functionality, then deployed to production with zero downtime.

How often does Adobe release security patches?

Adobe typically releases security patches every quarter as part of their scheduled release cycle, with additional out-of-band patches for critical vulnerabilities. We monitor every release and act immediately.

What does a security audit involve?

We examine your entire Magento installation including core file integrity, extension vulnerabilities, admin access controls, server configuration, and payment handling. You receive a detailed report with prioritised recommendations.

My store has been hacked. How fast can you help?

We offer emergency support with response times under 15 minutes. We'll identify the breach, remove malicious code, close the vulnerability, and get your store back online as quickly as possible.

Do I need PCI compliance for my Magento store?

If your store accepts card payments, you need to comply with PCI DSS requirements. Even if you use a hosted payment gateway, certain requirements still apply to your Magento installation and server environment.

Is Magento 1 still safe to run?

No. Magento 1 reached end of life in June 2020 and no longer receives security patches. Stores still running M1 have known, published vulnerabilities that attackers actively scan for. Migration to Magento 2 is strongly recommended.

How do I know if my Magento store has been hacked?

Signs of compromise include unknown admin users, modified checkout files, outbound traffic spikes, skimmer code injected into JavaScript files, and alerts from Adobe Commerce Security Scan. A security audit will identify these quickly.

How long does Magento hack recovery take?

Recovery from a confirmed compromise typically runs 1 to 3 days. The work includes identifying the attack vector, removing malware, patching the vulnerability, rotating credentials and restoring clean code from version control.

Do you report Magento incidents to the ICO?

If the compromise affects personal data, UK GDPR requires reporting to the Information Commissioner's Office within 72 hours. We help clients prepare the technical portion of the report but the legal obligation rests with the data controller.