Security Patches

Composer Patches

# Install security patch via composer
composer require magento/security-patches:1.0.0

# Apply specific patch
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy

Manual Patch Application

# Download patch from Magento Security Center
wget https://magento.com/patches/MAGETO-2024-001.patch

# Apply patch
git apply MAGETO-2024-001.patch

# Or with rejection handling
git apply --reject MAGETO-2024-001.patch

# Verify patch applied
git status

Using cweagans/composer-patches

// composer.json
{
    "require": {
        "cweagans/composer-patches": "^1.7"
    },
    "extra": {
        "patches": {
            "magento/module-customer": {
                "MAGETO-2024-001": "patches/MAGETO-2024-001.patch"
            }
        }
    }
}

Key Points

• Always backup before applying patches
• Test patches in staging environment first
• Use version control to track patch applications
• Document which patches are applied

Magento Security Center

// Subscribe to security alerts
// https:// magento.com/security

// Check current version
bin/magento --version

// Check for available updates
composer show magento/* --format=json | jq '.[].name'

Security Bulletin RSS

// Monitor security bulletins programmatically
class SecurityBulletinMonitor
{
    private $feedUrl = 'https://magento.com/security/feed';

    public function checkBulletins()
    {
        $feed = $this->fetchFeed($this->feedUrl);
        
        foreach ($feed['items'] as $item) {
            if ($this->isApplicableToCurrentVersion($item['title'])) {
                $this->alert($item);
            }
        }
    }

    private function isApplicableToCurrentVersion($bulletin)
    {
        $currentVersion = $this->getCurrentVersion();
        return strpos($bulletin, $currentVersion) !== false;
    }
}

Automated Update Checks

# Cron job for update checks
0 0 * * * cd /var/www/magento && bin/magento setup:check

# Composer update check
composer outdated magento/*

Key Points

• Subscribe to Magento security announcements
• Monitor CVSS scores for severity
• Prioritize critical vulnerabilities (CVSS >= 9.0)
• Document bulletin tracking process

Staged Rollout Process

# .gitlab-ci.yml / .github/workflows/update.yml
stages:
  - test
  - staging
  - production

security-patch:
  stage: test
  script:
    - composer require magento/security-patches:1.0.0
    - bin/magento setup:upgrade
    - bin/magento setup:di:compile
    - php bin/magento module:enable --all
    - phpunit tests/
  only:
    - security-patches

deploy-staging:
  stage: staging
  script:
    - bin/magento setup:upgrade
    - bin/magento cache:clean
  environment:
    name: staging
  only:
    - security-patches

deploy-production:
  stage: production
  script:
    - bin/magento setup:upgrade
    - bin/magento cache:clean
  environment:
    name: production
  when: manual
  only:
    - security-patches

Rollback Plan

// Rollback procedure
public function rollback($patchVersion)
{
    // 1. Put site in maintenance mode
    exec('bin/magento maintenance:enable');
    
    // 2. Restore from backup
    exec('git checkout ' . $patchVersion);
    
    // 3. Run setup
    exec('bin/magento setup:upgrade');
    exec('bin/magento setup:di:compile');
    exec('bin/magento setup:static-content:deploy');
    
    // 4. Clear cache
    exec('bin/magento cache:clean');
    
    // 5. Disable maintenance mode
    exec('bin/magento maintenance:disable');
}

Key Points

• Test patches in staging before production
• Have rollback plan ready
• Schedule patches during low-traffic periods
• Monitor after deployment for issues

Automated Testing

// Run full test suite after patch
use PHPUnit\Framework\TestCase;

class PatchVerificationTest extends TestCase
{
    public function testSecurityPatchApplied()
    {
        $composer = json_decode(file_get_contents('composer.json'), true);
        $patchVersion = $composer['require']['magento/security-patches'] ?? null;
        
        $this->assertNotNull($patchVersion, 'Security patch not installed');
        $this->assertStringStartsWith('1.0.', $patchVersion);
    }

    public function testVulnerabilityPatched()
    {
        // Test that specific vulnerability is fixed
        $response = $this->sendMaliciousRequest();
        $this->assertEquals(403, $response->getStatusCode());
    }
}

Manual Verification

# Verify patch files
find . -name "*.patch" -exec echo {} \;

# Check modified files
git diff --name-only HEAD~1

# Verify database schema
grep -r "ALTER TABLE" var/log/

# Run security scanner
bin/magento security:check

Security Scanning

// Post-patch security scan
class PostPatchScan
{
    public function scan()
    {
        $checks = [
            'file_permissions' => $this->checkFilePermissions(),
            'known_vulnerabilities' => $this->checkVulnerabilities(),
            'configuration' => $this->checkSecurityConfig(),
        ];

        return $checks;
    }
}

Key Points

• Run full test suite after patching
• Verify file permissions haven't changed
• Check for new security warnings
• Document verification results