The Red Hat incident: what it means for Magento shops
In 2025 attackers compromised a GitLab instance used by Red Hat Consulting. What is confirmed, what is not, and which precautions make sense for Magento shops.
In early October 2025, Red Hat confirmed that unauthorised parties had accessed a GitLab instance that Red Hat Consulting uses for collaboration with clients. A group called "Crimson Collective" claimed responsibility.
What is confirmed and what is not
Confirmed by Red Hat is the access to this one GitLab instance. According to Red Hat, other services and products are not affected.
Not confirmed are the attackers' claims: about 570 GB of data from more than 28,000 repositories, including some 800 consulting reports for clients. Such reports can contain infrastructure details, configurations and credentials. The published client list includes large technology companies, among them Adobe.
A correction
In the first version of this post I advised against running composer update for the time being. That was overly cautious. There is no indication that Magento or Composer packages were tampered with. In the long run, not applying security updates is the bigger risk.
What I advise shop owners
- Keep applying updates, but in a controlled way: via
composer.lock, on staging, with a look at the changed packages - Only use packages from known sources (repo.magento.com, Packagist, vendor repositories)
- Run
composer auditregularly - If you were a Red Hat Consulting client yourself: rotate credentials and tokens used in projects with Red Hat
The incident is a good opportunity to review your own update process. If you would like help with that, write to me.
Sources: BleepingComputer · SecurityWeek. As of October 2025, revised in October 2026.