[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"MnvP6lC8wt":3,"related-supabase-notes/weekly-roundup-2026-09-18":30},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":26,"published_at":27,"created_at":28,"updated_at":29},"37675193-0337-4634-bafa-c503df69b0c6","notes/weekly-roundup-2026-09-18","Weekly round-up: StyleSmuggler clean-up, a Supabase deadline, and the Claude Code limits shuffle","A week on from the Magento zero day, the mopping-up is where the real work is. Plus a Supabase logs endpoint being removed on 23 September, and the Claude Code limits change that is both a rise and a cut.","Round-up: StyleSmuggler clean-up and a Supabase deadline","The week after the Magento zero day: patching is the easy part, Supabase removes logs.all on 23 September, and Claude Code's limits moved.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"05618c11-d93d-4bf0-9b97-63c1cfc96da7",{"content":15,"maxWidth":16},"\u003Cp>Last week's round-up was mostly one story, the Magento zero day. This week is the less dramatic half of it, which is where the actual work lives, plus two smaller things that will bite if you are not looking.\u003C/p>\u003Ch2>StyleSmuggler: patching was the easy bit\u003C/h2>\u003Cp>A quick recap for anyone who missed it. CVE-2026-75650, which Sansec named StyleSmuggler, is an unauthenticated remote code execution flaw in Magento Open Source and Adobe Commerce, scored 10.0. Exploitation started on 4 September, Adobe shipped the emergency hotfix VULN-39341 on the 7th, and the regular September bulletin APSB26-138 followed on the 8th. Every version from 2.4.4 to 2.4.9 is affected. \u003Ca href=\"https://sansec.io/research/stylesmuggler-0day\">Sansec's write-up\u003C/a> is the primary source.\u003C/p>\u003Cp>What has changed this week is the shape of the problem. CrowdSec reports \u003Ca href=\"https://www.crowdsec.net/vulntracking-report/cve-2026-75650-stylesmuggler-rce-adobe-commerce-magento\">around 500 distinct IPs\u003C/a> sending matching requests since 9 September, which is the opportunists arriving after the tooling went public. The flaw is on the \u003Ca href=\"https://www.rescana.com/post/magento-stylesmuggler-cve-2026-75650-kev\">CISA known exploited list\u003C/a>. And Sansec documented at least one store that had the July and August patches applied and was still compromised, because the hotfix came after the attackers did.\u003C/p>\u003Cp>So if you patched on the 7th or 8th and stopped there, you are not done. The three-day window before the hotfix means \"am I patched\" and \"was I compromised\" are separate questions. Rotate the encryption key and the admin and integration credentials, check the product image cache directory for PHP files that should not be there (that is where the second attacker in Sansec's report dropped a web shell), and compare the code on disk against a clean copy. \u003Ca href=\"https://swissuplabs.com/blog/stylesmuggler-magento-2-zero-day-how-to-check-mitigate-and-clean-an-affected-store/\">Swiss Up Labs has a practical checklist\u003C/a> for the check-and-clean part.\u003C/p>\u003Cp>I have said this before and I will keep saying it: the stores that come out of weeks like this fine are the ones where somebody owns patching as a job, not a favour. If nobody at your company can tell you the date of your last security patch, that is the finding. \u003Ca href=\"/notes/magento-support-and-maintenance-what-a-retainer-covers\">What a proper retainer covers\u003C/a> is queued for next month and this is the reason it exists.\u003C/p>\u003Ch2>Supabase: logs.all goes on 23 September\u003C/h2>\u003Cp>A small one that will break a script somewhere. The Management API endpoint logs.all is being removed on 23 September, and the replacement is the ClickHouse-backed logs endpoint, which takes ClickHouse SQL only. If you have any monitoring, alerting or a cron that pulls logs through the old endpoint, it stops working on Wednesday. The \u003Ca href=\"https://supabase.com/changelog\">Supabase changelog\u003C/a> has the entry.\u003C/p>\u003Cp>The typical victim is a little script that pulls auth failures nightly and posts a count somewhere. Moving it is a twenty-minute job if you find out this week, and a confusing Thursday morning if you do not. Worth a grep.\u003C/p>\u003Ch2>Claude Code's limits: up 25% and down 17%, both true\u003C/h2>\u003Cp>On 14 September Anthropic changed the weekly usage limits on Claude Code for Pro, Max, Team and seat-based Enterprise plans. The headline was a permanent 25% increase over the pre-promotion standard limit. The follow-up was that, compared with the temporary 50% boost that had been running since May, it works out as a 17% reduction. Index the old standard at 100, the summer boost at 150, and the new level at 125, and both numbers fall out. \u003Ca href=\"https://www.digitalapplied.com/blog/claude-code-weekly-limit-reduction-september-14\">Digital Applied's post\u003C/a> does the arithmetic and is careful about what Anthropic actually said versus what got repeated.\u003C/p>\u003Cp>My take: if you only ever hit the ceiling in the summer, you were budgeting against a promotion. Route routine work to the cheaper models and most people will not notice, but if you run a team on it, re-do the seat maths at 125 rather than 150 and stop treating the boost as the baseline. The same week, Claude Code 2.1.271 added fast mode to remote sessions, which for me matters more than the limit change; the \u003Ca href=\"https://code.claude.com/docs/en/changelog\">changelog\u003C/a> has the detail.\u003C/p>\u003Ch2>What I published this week\u003C/h2>\u003Cp>Monday was \u003Ca href=\"/notes/can-your-team-actually-edit-a-headless-cms\">can your team actually edit a headless CMS\u003C/a>, which is the question I get asked most by non-technical owners and the one most headless vendors answer badly. Thursday was \u003Ca href=\"/notes/how-to-prepare-for-a-headless-migration\">how to prepare for a headless migration\u003C/a>: the content audit, the redirect map and the decision about what not to bring, all of which happen before anyone writes a line of code.\u003C/p>\u003Cp>Next week is Monday's \u003Ca href=\"/notes/replatform-or-fix-your-magento-store\">replatform or fix your Magento store\u003C/a>, which given the last fortnight is landing at about the right time.\u003C/p>\u003Ch2>One line for the weekend\u003C/h2>\u003Cp>If you run Magento and have not read the Sansec report properly, do that before anything else. If you run Supabase and have any script that mentions logs.all, fix it before Wednesday. Everything else can wait.\u003C/p>","lg","wysiwyg","",{"author":20},"Adam Jackson",[22,23,24,25],"roundup","magento","supabase","ai",true,"2026-09-19T06:13:53.415+00:00","2026-09-18T06:10:00+00:00","2026-10-01T19:41:42.773395+00:00",[31,42,52,63,74,86,96],{"id":32,"slug":33,"title":34,"excerpt":35,"meta_title":36,"meta_description":37,"featured_image":18,"fields":38,"tags":40,"published":26,"published_at":41,"created_at":41,"updated_at":41},"373d4861-e13f-4d2b-9035-3447f516db09","notes/weekly-roundup-2026-10-23","Weekly round-up: a PHP patch that matters more than the Magento one","A critical PHP release, no new Magento bulletin, a Supabase TLS date 18 days out, and WordPress 7.2 Beta 1.","Weekly Round-Up: PHP Patch, Magento and Supabase","This week: a critical PHP release, Magento after APSB26-153, the Supabase TLS date and WordPress 7.2 Beta 1.",{"author":39},"Headless Digital",[22,23,24],"2026-10-23T07:06:14.944319+00:00",{"id":43,"slug":44,"title":45,"excerpt":46,"meta_title":47,"meta_description":48,"featured_image":18,"fields":49,"tags":50,"published":26,"published_at":51,"created_at":51,"updated_at":51},"3fa30c75-b63a-4414-8078-bf9a57b7eb3c","notes/weekly-roundup-2026-10-16","Weekly round-up: Magento APSB26-153 and a Supabase TLS deadline","Adobe's APSB26-153 has five critical Magento fixes, Supabase disables old TLS 1.2 ciphers on 10 November, and the .NET SDK grows up.","Weekly Round-Up: Magento APSB26-153, Supabase TLS","This week: Magento APSB26-153 with five critical fixes, Supabase disabling old TLS 1.2 ciphers on 10 November, and .NET SDK updates.",{"author":39},[22,23,24],"2026-10-16T07:14:57.117895+00:00",{"id":53,"slug":54,"title":55,"excerpt":56,"meta_title":57,"meta_description":58,"featured_image":18,"fields":59,"tags":60,"published":26,"published_at":62,"created_at":62,"updated_at":62},"cdfe1566-04cc-4260-96ab-1f2d0bf327d7","notes/weekly-roundup-2026-10-09","Weekly round-up: Nuxt 4.6, scoped Supabase tokens, and a December deadline","Nuxt 4.6 and the end of Nuxt 3, scoped Supabase personal access tokens, the 1 December adapter removal, and WordPress 7.1.3.","Weekly Round-Up: Nuxt 4.6, Supabase Scoped Tokens","This week: Nuxt 4.6 and Nuxt 3 end of life, scoped Supabase access tokens, a 1 December deprecation date, and WordPress 7.1.3.",{"author":39},[22,24,61],"nuxt","2026-10-09T07:14:08.209884+00:00",{"id":64,"slug":65,"title":66,"excerpt":67,"meta_title":68,"meta_description":69,"featured_image":18,"fields":70,"tags":71,"published":26,"published_at":73,"created_at":73,"updated_at":73},"4b57ca81-a3e2-4785-a023-dcbdf8c077d5","notes/weekly-roundup-2026-10-02","Weekly round-up: Postgres security release, OrioleDB beta, and Supabase Middleware 1.0","Supabase's Postgres security release with four breaking changes, OrioleDB in public beta, Supabase Middleware 1.0, and a note on WordPress 7.1.2.","Weekly Round-Up: Postgres Release, OrioleDB Beta","This week: Supabase's Postgres 17.11 security release and its four breaking changes, OrioleDB public beta, and Supabase Middleware 1.0.",{"author":39},[22,24,72],"wordpress","2026-10-02T07:13:16.097003+00:00",{"id":75,"slug":76,"title":77,"excerpt":78,"meta_title":79,"meta_description":80,"featured_image":18,"fields":81,"tags":82,"published":26,"published_at":83,"created_at":84,"updated_at":85},"fd7b0e56-d3d2-4824-a2ce-2948a6ecfa7d","notes/why-16000-supabase-databases-were-left-exposed","16,326 Supabase Databases Were Left Exposed. Here's Why","UpGuard found over 16,000 public Supabase databases leaking real personal data this week. The cause traces back to one setting, and it's worth checking on your own project.","16,000 Exposed Supabase Databases: What Happened","UpGuard found 16,326 public Supabase databases leaking real data this week. The cause was one setting. Here's what to check on your own project.",{"author":20},[24,25],"2026-10-02T08:00:00+00:00","2026-09-27T07:18:05.689274+00:00","2026-10-02T08:00:01.68075+00:00",{"id":87,"slug":88,"title":89,"excerpt":90,"meta_title":91,"meta_description":92,"featured_image":18,"fields":93,"tags":94,"published":26,"published_at":95,"created_at":95,"updated_at":29},"d75fb417-2460-4469-b103-4e062f46d229","notes/weekly-roundup-2026-09-25","Weekly round-up: a critical WordPress RCE, Nuxt's build layer swap, and Claude gets serious about small business","A critical WordPress RCE worth patching today, Nuxt 4.5's build layer swap, Claude for Small Business grows up, and a quick look at this month's Supabase changelog.","Weekly Round-Up: WordPress RCE, Nuxt 4.5, Claude for SMBs","This week: a critical WordPress RCE worth patching today, Nuxt 4.5's new build layer, Claude for Small Business grows up, and a Supabase changelog look.",{"author":20},[22,72,61,25,24],"2026-09-25T07:19:43.316037+00:00",{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":97,"tags":98,"published":26,"published_at":27,"created_at":28,"updated_at":29},{"author":20},[22,23,24,25],1792742460331]