October 2023: Core Security + Connected Cloud

October 2023 combined a solid security patch train with practical cloud improvements. Adobe shipped 2.4.6-p3 (and parallel 2.4.5-p5, 2.4.4-p6) addressing security issues and refreshing dependencies. For estates already on 2.4.6, the p3 update was a low-risk step that reduced noise and kept the platform aligned with current upstreams.

On Adobe Commerce cloud infrastructure, incremental upgrades to base images and ECE-Tools helped modernise services without forcing a major application jump. Teams reviewed Redis, Varnish and RabbitMQ versions, adjusted static content deployment options (SCD), and validated search and queue behaviour after image bumps. The headline is not dramatic change, but a cleaner, better-tuned baseline for Q4 trading.

Security posture took centre stage. We recommended enforcing least-privilege IAM, rotating long-lived secrets, and enabling audit trails for sensitive actions in CI/CD and admin. For client-facing controls, WAF policies and CDN rules were aligned with updated CSP directives and new third-party scripts. Where possible, we enabled CSP report-only first, reviewed violations, then tightened policies.

Operationally, this was a good moment to consolidate: remove unused modules, pin Composer versions, and reindex and warm caches after each deploy to prevent first-hit performance drops. For headless builds, we added edge caching for GraphQL where safe and ensured session cookies were disabled for anonymous queries.

Recommended actions:

• Upgrade to the latest p-line (2.4.6-p3 or equivalent) and re-run integration tests.
• Refresh cloud build images and confirm Redis, Varnish and RabbitMQ versions meet support matrices.
• Rotate CI/CD credentials and service keys; enforce least-privilege roles.
• Pin Composer dependencies with a clean lockfile; verify integrity in CI.
• Enable CSP reporting; review and tighten where safe; align WAF/CDN rules.

The outcome is a more predictable peak season with fewer surprises and faster incident response if issues arise.