Last Thursday, 22 October, the Magento community met in Mainz for Meet Magento Germany. The organisers invited me to give a talk on security, so off I went.

No direct flights from Brno and railway maintenance meant I eventually drove all the way.

It was worth the trip.

The pyramid in Mainz where Meet Magento Germany 2026 took place

A conference in a pyramid

How often do you get the opportunity to give a talk in a pyramid? This year, Meet Magento DE took place exactly there, in the pyramid in Mainz. The programme ran on four stages at once – Main Stage, Tech Stage, Business Stage and Masterclass.

In the evening, everyone moved up to the very top of the pyramid and the discussions continued over German beer. Sadly, there was no Czech beer on tap, but I survived :).

Entrance to Meet Magento Germany – est. 2009

For readers outside the Magento ecosystem: Meet Magento is a series of conferences held all over the world. It all started in 2009, right here in Germany. Merchants, agencies, developers and module authors all come together there.

Talks worth mentioning

Keynote – Steve Richards. No product pitch. Steve looked back on his life and connected his experience from social work in Africa with today's world of AI and IT. Unexpected, in a good way. It set the mood for the whole day.

Tsari Bombelli – will ChatGPT recommend your store? This talk made me rethink how I approach content optimisation for AI. We spend a lot of time talking about Google, but the world doesn't revolve around it anymore. Fun fact: the llms.txt file everyone is writing about is barely read by AI so far. What matters more is robots.txt – whether you let AI onto your site at all. (And yes, this site has an llms.txt. It doesn't hurt.)

Laurentius from Storeframe shared how he interviewed the hacker behind a series of attacks targeting the Magento PolyShell vulnerability. If you haven't read it yet, here's the interview.

Michiel and the Mage-OS team showed what they've been working on, including their own AI assistant, Mago.

The main hall in the pyramid during my talk

My talk – "The Priority We're Getting Wrong: Security"

In the main hall, I opened a topic that often gets pushed aside in e-commerce – security. What's at stake, where we stand today and how to make security updates as boring as possible.

Boring is the highest compliment here.

Intro of my talk at Meet Magento Germany 2026

The talk also included data. I looked at almost 27,000 Magento stores, and nearly a fifth of them hadn't even deployed the isolated security patch from July.

We can do better. The AI era pushes us to keep moving forward, but attackers on the other side have the same tools. That's why we need to put even more emphasis on security than before.

Some problems need changes across the whole ecosystem – for example, shipping fixes as proper Composer releases again, or wider use of composer audit (including for private repositories). Others we can solve by helping merchants and fellow developers understand what really matters.

I closed the talk with this line:

In the race for new features, you lose slowly. In security, you lose everything at once.

On stage in the main hall

The hallway talk was all about PHP

The day before the conference, emergency fixes were released for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that let an attacker take over a server without logging in. On top of that, details had already leaked a day earlier.

Fixes were only released for PHP 8.2 and newer – specifically 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Plenty of people in the room spent the night before the conference updating applications and servers. The news caught me on my way to Mainz.

I couldn't have ordered a better illustration for a talk about security updates.

Mostly about people

The most valuable part, though, happened between the talks. At the tables, people discussed everything from late-night server updates to how individual teams work with AI.

The Pac-Man Rule worked really well: when you're standing in a group, leave a gap in the circle so anyone can join.

Selfie from the stage

Why I go to Meet Magento

I'm usually the only one from the Czech Republic and Slovakia at these conferences. That's a shame, because the main strength of a platform like Magento is the community around it. Nowhere do you learn as much as at a conference while waiting for coffee. And it works both ways – whatever I learn, I'm happy to pass on, whether on stage, over a beer, or here on the blog.

Christian Münch wrote a more detailed recap of the whole conference.

A great event!