A new version of Magento has been released. Since a potential vulnerability was fixed, we’re considering this a security fix and we recommend all Magento website owners have this upgrade done.
Magento Open Source 18.104.22.168 Release Notes (Magento.com)
This patch (SUPEE-10266) provides resolution of multiple critical security issues and several functional fixes. These critical security issues include remote code execution, cross-site scripting, and cross-site request forgery issues. We recommend upgrading your Magento store to this latest version. See Magento Security Center for a comprehensive discussion of these issues.
This release also provides support for the following functional issues:
- We’ve fixed an issue where uploaded images were twice their original size after you applied SUPEE-9767 v2.
- We’ve added an informative message to the payment information section of the one-page checkout to alert customers that no payment is due for orders that total 0.0.
SUPEE-10266, Magento Commerce 22.214.171.124 and Open Source 126.96.36.199 contain multiple security enhancements that help close cross-site request forgery (CSRF), unauthorized data leak, and authenticated Admin user remote code execution vulnerabilities. These releases also include fixes for issues with image reloading and payments using one-step checkout.
Patches and upgrades are available for the following Magento versions:
- Magento Commerce 188.8.131.52-184.108.40.206: SUPEE-10266 or upgrade to Magento Commerce 220.127.116.11
- Magento Open Source 18.104.22.168-22.214.171.124: SUPEE-10266 or upgrade to Magento Open Source 126.96.36.199
Magento version 188.8.131.52 was skipped.
Our Website Maintenance Department will be in contact with our clients regarding this upgrade. If you need this upgrade done on your website, please contact us.