Magento 2.3.5 Security Breach: Why Outdated Versions Are a Critical Risk and Where to Find Upgrade Support

Outdated Magento 2.3.5 Site Hacked: A GitHub Issue Reveals Critical Upgrade Needs and Community Misconceptions

As e-commerce migration experts at Shopping Mover, we often encounter the critical challenges faced by merchants running outdated Magento installations. This GitHub issue, initially reported as a 'Magento upgrade' request, serves as a stark reminder of the severe risks associated with neglecting platform updates and clarifies the appropriate channels for seeking assistance.

The issue originated from a Magento 2.3.5 store that suffered a malware attack. The hosting provider, Nexcess, successfully quarantined the malicious files and implemented .htaccess rules to block further uploads. However, their primary recommendation was unequivocal: the site's Magento 2.3.5 version was riddled with vulnerabilities, necessitating an urgent upgrade to the latest version and the installation of all available security patches. The report detailed the discovery of malicious files, provided guidance on checking site integrity after remediation, and linked to resources for securing compromised sites.

The store owner's 'proposed solution' was to ask the Magento core team via GitHub to perform an upgrade service. This highlights a common misconception about the purpose of the Magento 2 GitHub repository.

The Community's Response and Clarification

The Magento core team's response was swift and instructive. The issue was closed with a clear explanation from 'engcom-Bravo', stating that the public GitHub repository is exclusively for reporting and processing issues related to the latest Magento 2.4 core code. Requests for upgrades or issues pertaining to unsupported, older versions like 2.3.5, or general support inquiries, do not fall within its scope.

The team further advised that such 'bugs' (referring to issues that might arise during a data migration process) should be reported in the magento/data-migration-tool repository. However, in this specific instance, the user wasn't reporting a bug with the migration tool itself, but rather requesting a service. This distinction is crucial for merchants and developers alike: GitHub is for collaborative code development and bug fixing, not for direct support or service requests.

Key Takeaways for Magento Merchants and Developers

• Urgency of Upgrades: Running outdated Magento 2 versions, especially those past their end-of-life, exposes your store to critical security vulnerabilities. As demonstrated by this incident, malware attacks are a tangible and severe threat. Regular upgrades and timely application of security patches are non-negotiable for e-commerce security.
• Understanding GitHub's Role: The Magento 2 GitHub repository is a vital resource for core code contributions, bug reports for supported versions (currently 2.4.x), and community collaboration on development. It is not a channel for general support, hosting issues, or requesting upgrade services.
• Seeking Professional Help: For complex tasks like Magento upgrades, especially from significantly older versions, engaging experienced Magento development agencies or migration experts is highly recommended. These professionals can ensure a smooth, secure, and data-integrity-preserving transition.
• Data Migration Tool: While this issue wasn't a bug in the tool, the mention of the `data-migration-tool` repository reminds us of the dedicated resources available for developers facing technical challenges during the migration process itself.

This incident underscores the importance of a proactive approach to Magento security and maintenance. It also serves as an excellent example of the Magento community's efforts to guide users toward the most effective channels for their specific needs, ensuring that core development remains focused and efficient.