Magento & Mage-OS version and patch tracker
Is Magento end of life? No: Magento itself is not end of life, but each release line reaches the end of support on its own date. The latest version is Magento Open Source and Adobe Commerce 2.4.9, released on 12 May 2026 and supported until 31 May 2029. Since July 2026 Adobe has shipped monthly isolated security patches on top of each line's latest -p release, so "up to date" now means the latest -p release plus every monthly patch, applied in order.
Last updated: , for Adobe's October 2026 security bulletin APSB26-153, published on 13 October 2026. The Mage-OS rows are as checked on 21 October 2026.
| Version | Latest patch | Release date | End of support | PHPRequired by the release |
|---|---|---|---|---|
| Magento 2.4.9 | 2.4.9 (no -p release yet), plus the 2.4.9-2026-sep (8 September 2026) and 2.4.9-2026-oct (13 October 2026) isolated patches and the VULN-39341 hotfix (7 September 2026) | 12 May 2026 | Standard support to 31 May 2029 | 8.5 |
| Magento 2.4.8 | 2.4.8-p5 (12 May 2026), plus 2.4.8-2026-sep, 2.4.8-2026-oct and VULN-39341. Adobe revised the October Community Edition patch on 16 October 2026 under the same filename: if you applied the original, download it again, reverse the original and apply the new copy (staging first). The Commerce Version Tool lists 248p5-2026-10-002-CE as missing until you do. Adobe says the original already contained the required fix and the revision adds defence in depth | 8 April 2025 | Standard support to 31 May 2028 | 8.4, 8.3 |
| Magento 2.4.7 | 2.4.7-p10 (12 May 2026), plus 2.4.7-2026-sep, 2.4.7-2026-oct and VULN-39341 | 9 April 2024 | Standard support to 31 May 2027. Adobe Commerce: extended support to 31 May 2028 | 8.3, 8.2 |
| Magento 2.4.6 | 2.4.6-p15 (12 May 2026). Adobe Commerce: plus 2.4.6-2026-sep, 2.4.6-2026-oct and VULN-39341. Open Source: no September or October 2026 patch listed, although Adobe lists 2.4.6 as affected by the October bulletin | 14 March 2023 | Standard support ended 11 August 2026. Adobe Commerce: extended support to 31 August 2027, security-only to 31 May 2028 | 8.2, 8.1 |
| Magento 2.4.5 | 2.4.5-p17 (12 May 2026). Adobe Commerce only: plus 2.4.5-2026-sep, 2.4.5-2026-oct and VULN-39341 | 9 August 2022 | Standard support ended 12 August 2025, extended support 11 August 2026. Adobe Commerce: security-only to 31 May 2027 | 8.1 |
| Magento 2.4.4 | 2.4.4-p18 (12 May 2026). Adobe Commerce only: plus 2.4.4-2026-sep, 2.4.4-2026-oct and VULN-39341 | 12 April 2022 | Standard support ended 12 April 2025, extended support 14 April 2026. Adobe Commerce: security-only to 31 May 2027 | 8.1 |
| Magento 1 (Open Source 1.9.x, Commerce 1.14.x) | SUPEE-11346, the final security patch (bulletin APSB20-41, 22 June 2020) | Not applicable | Ended June 2020 | Not stated by Adobe |
| Mage-OS 3.x | 3.6.0 (14 October 2026), built on Magento Open Source 2.4.9, porting Adobe's October 2026 isolated patch 249-2026-10-001-CE (APSB26-153) on top of the earlier ports. Mage-OS says 3.5.0 reached end of life with this release | 3.0.0: May 2026 | Mage-OS supports only its latest release | 8.3 to 8.5 (Mage-OS) |
| Mage-OS 2.x | 2.3.0, built on Magento Open Source 2.4.8-p5: the last planned 2.x release, with no later security fixes ported | May 2026 | No further fixes (Mage-OS supports only its latest release) | 8.3, 8.4 (Mage-OS) |
- Adobe Commerce only: extended support and the security-only period are described by Adobe for Adobe Commerce customers. Adobe's September and October 2026 notes say Open Source merchants can download patches for 2.4.7 or later.
- October 2026 (APSB26-153): a priority 2 update. Its most serious fix, CVE-2026-103849, is rated critical with a CVSS score of 10.0 and needs no login to exploit; Adobe says it is not aware of any exploits in the wild. The fixes come as isolated patch files, applied on top of the latest -p release and every earlier monthly patch, in order. Adobe says the September hotfix for CVE-2026-75650 is still needed, and it strongly recommends rotating encryption keys and associated credentials. The same bulletin lists 2.4.10-alpha1, the first alpha of the next release line.
- PHP: the versions Adobe (or Mage-OS, for Mage-OS) lists for each release. They are requirements, not what a particular host runs; we match each server's stack to the version the store needs.
- Applying patches: test each patch on a staging copy first, then coordinate it to production. See Magento upgrades and security patching.
Sources, checked 21 October 2026: Adobe's lifecycle policy, released versions, system requirements, release schedule, security bulletins (including APSB26-138, APSB26-146 and APSB26-153), the September 2026 and October 2026 patch notes, the revised 2.4.8-p5 October patch note and APSB20-41 for Magento 1; Mage-OS releases, roadmap, 3.0.0 notes, 2.3.0 notes and 3.6.0 notes.
Is Magento end of life?
No. Magento itself is not end of life. Individual Magento 2 release lines reach the end of support at different dates.
Adobe released Magento Open Source and Adobe Commerce 2.4.9 on 12 May 2026 and lists support for it until 31 May 2029, and Adobe's patch release schedule commits to a full 2.4.x release every year in May. 2.4.8 is supported until 31 May 2028 and 2.4.7 until 31 May 2027. The useful question is not "is Magento end of life" but "is my version still supported", and the table below answers it.
Two older generations are a different matter. Adobe ended support for Magento 1 in June 2020, and the 2.3 line is fully out of support, with 2.3.7-p4 listed by Adobe as its final release. Stores on either need a migration rather than a patch: see our guide to Magento 2 migration for moving from Magento 1.
Magento support dates by version
Source: Adobe's software lifecycle policy (last updated 18 September 2026) and released versions page (12 August 2026). The lifecycle policy is written for Adobe Commerce; extended support and the security-only period are defined for Adobe Commerce customers. The Magento Open Source position is set out in the next section. "TBD" and "N/A" are Adobe's own entries.
| Version | General availability | Standard support ends | Extended support endsAdobe Commerce | Security-only period endsAdobe Commerce | Status on 16 October 2026 | Recommended action | What we run |
|---|---|---|---|---|---|---|---|
| 2.4.9 | 12 May 2026 | 31 May 2029 | TBD | N/A | Supported (latest release) | Stay on the latest security patch | We run the PHP, database, search and cache versions this release needs. |
| 2.4.8 | 8 April 2025 | 31 May 2028 | TBD | N/A | Supported | Stay patched; plan 2.4.9 when your extensions allow | We run the PHP, database, search and cache versions this release needs. |
| 2.4.7 | 9 April 2024 | 31 May 2027 | 31 May 2028 | N/A | Supported, standard support ends in about 8 months | Book the upgrade for early 2027 at the latest | We run the PHP, database, search and cache versions this release needs. |
| 2.4.6 | 14 March 2023 | 11 August 2026 | 31 August 2027 | 31 May 2028 | Past standard support. Adobe Commerce: in extended support | Open Source: upgrade now. Adobe Commerce: plan the upgrade | We run the PHP, database, search and cache versions this release needs. We can host it while you plan your upgrade, and prepare a staging copy for your developer or agency. |
| 2.4.5 | 9 August 2022 | 12 August 2025 | 11 August 2026 | 31 May 2027 | Past standard and extended support. Adobe Commerce: security-only period | Upgrade now | We run the PHP, database, search and cache versions this release needs. We can host it while you plan your upgrade, and prepare a staging copy for your developer or agency. |
| 2.4.4 | 12 April 2022 | 12 April 2025 | 14 April 2026 | 31 May 2027 | Past standard and extended support. Adobe Commerce: security-only period | Upgrade now | We run the PHP, database, search and cache versions this release needs. We can host it while you plan your upgrade, and prepare a staging copy for your developer or agency. |
How to read the three support phases
- Standard support: three years from general availability, with quality fixes and security patches.
- Extended support: in Adobe's words, "one year of additional support at no additional cost for Adobe Commerce customers on versions 2.4.6 and 2.4.7", covering quality and security patches for the core application. Extended support for 2.4.4 and 2.4.5 ended in April and August 2026.
- Security-only transitional period: "a one-time, time-limited transitional period available only for versions 2.4.4, 2.4.5, and 2.4.6", providing "limited isolated security fixes only (no quality fixes)". Adobe states it will not be extended and should be treated as migration time, not a support tier.
Magento Open Source vs Adobe Commerce: what the evidence says
Adobe's lifecycle policy is an Adobe Commerce document, and Adobe has not published a separate lifecycle policy for Magento Open Source. The Open Source position therefore has to be read from what Adobe actually ships and says:
- Adobe publishes Magento Open Source release notes for each 2.4.x version, and Open Source security patch releases have shipped alongside Adobe Commerce ones for lines in standard support: 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 were all released for Open Source on 12 May 2026, while 2.4.6 was still in standard support.
- Adobe's September 2026 security update notes state: "Open Source merchants can only download patches for version 2.4.7 or later". Those are the lines still in standard support.
- Extended support and the security-only period appear in Adobe's lifecycle policy for Adobe Commerce customers only. Nothing Adobe has published extends them to Open Source.
| Provision | Adobe Commerce (licensed) | Magento Open Source |
|---|---|---|
| Standard support (3 years) | Yes, per Adobe's lifecycle policy | No separate policy published; releases and patches have tracked the same lines during standard support |
| Extended support | Yes: 2.4.6 to 31 Aug 2027, 2.4.7 to 31 May 2028 (2.4.4 and 2.4.5 ended) | Not described by Adobe |
| Security-only period | Yes: 2.4.4 and 2.4.5 to 31 May 2027, 2.4.6 to 31 May 2028 | Not described by Adobe |
| Regular security patch downloads | All lines 2.4.4 to 2.4.9 (September and October 2026 bulletins) | 2.4.7 or later (Adobe, September and October 2026) |
In practice: if you run Magento Open Source 2.4.6 today, the 31 August 2027 and 31 May 2028 dates you may have seen quoted are Adobe Commerce dates. Your line left standard support on 11 August 2026, and Adobe has not committed to anything further for it.
Adobe can still issue an emergency fix for an older line when it chooses to. Its hotfix for the actively exploited CVE-2026-75650 (7 September 2026) was published for Magento Open Source 2.4.6 to 2.4.9 as well as Adobe Commerce 2.4.4 to 2.4.9. That is an exception you cannot plan around, not a sign that 2.4.6 Open Source is supported.
Adobe Commerce on Cloud has a further deadline. Adobe's version upgrade enforcement policy for Adobe Commerce on Cloud infrastructure (the PaaS product) requires 2.4.4 and 2.4.5 environments to be upgraded by 1 June 2027 and 2.4.6 and 2.4.7 environments by 1 June 2028, with earlier deadlines of 30 October 2026 and 31 May 2027 for third-party dependencies such as PHP, MariaDB, Elasticsearch and Redis. Non-compliant environments have inbound traffic suspended and may then be decommissioned. This applies to Adobe Commerce on Cloud only, not to on-premises Adobe Commerce or to Magento Open Source.
What happens when a Magento version reaches end of life
Nothing visible happens on the day. Pages load, checkout works, orders arrive. What changes is quieter, and it compounds:
- You can no longer rely on security patches for that line. Routine fixes go to supported lines. Adobe's regular October 2026 update (APSB26-153) is the current example: patches were issued for Adobe Commerce 2.4.4 to 2.4.9, with Open Source downloads limited to 2.4.7 or later, as in September. Adobe may exceptionally patch an older line, as it did for CVE-2026-75650, but it does not commit to doing so.
- The supporting software ages out too. Adobe does not patch PHP, the database or the search engine. Per Adobe's system requirements, 2.4.6 runs on PHP 8.1 or 8.2. PHP 8.1 reached end of life on 31 December 2025 and PHP 8.2 reaches it on 31 December 2026. MySQL 8.0 reached end of support on 30 April 2026 and Adobe will not validate newer MySQL releases on 2.4.4 to 2.4.7. Elasticsearch 7.17 reached end of support on 15 January 2026.
- PCI DSS questions follow. Unsupported software that handles cardholder data can create PCI DSS compliance concerns. Adobe's lifecycle page says compliance is the merchant's responsibility to assess and recommends consulting your qualified security assessor; do that rather than assuming either way.
- Extension vendors move on. New releases of payment, shipping and search extensions are tested against supported lines, so the gap between your store and a current one widens with every vendor release.
For a detailed account of what this looks like on the line that most recently left standard support, read our Magento 2.4.6 end of life guide.
Check which Magento version you are running
The version appears in the footer of most Magento admin pages. From the command line, run this in the Magento root directory:
bin/magento --versionNote the patch level as well as the line. 2.4.8-p5 is the latest 2.4.8 patch release; plain 2.4.8 is missing more than a year of security fixes even though the line is supported. Adobe's isolated security patches (named like "2.4.8-p5-2026-aug") sit on top of the patch release and do not change the version number, so check your applied patch list as well.
Why patch status matters right now: CVE-2026-75650
On 7 September 2026 Adobe published security bulletin APSB26-146 for CVE-2026-75650, a critical flaw that lets an unauthenticated attacker execute arbitrary code, which Adobe says "has been exploited in the wild targeting Adobe Commerce merchants". It affects Adobe Commerce 2.4.4 to 2.4.9 and Magento Open Source 2.4.6 to 2.4.9, and the fix is the VULN-39341 hotfix plus a rotation of encryption keys and credentials. On a supported, current version that was a hotfix and a key rotation. On an unsupported line it depended on Adobe choosing to issue one, and the routine bulletin the following day did not reach Open Source below 2.4.7. Full detail, and the checks we ran across the stores we host, is in our StyleSmuggler zero-day write-up.
Magento release schedule: what to expect from Adobe
Adobe's patch release schedule sets out the cadence for the 2.4.x line: one full release a year in May (2.4.8 arrived 8 April 2025, 2.4.9 on 12 May 2026), one alpha and one beta a year ahead of it, security patches at least annually for every supported line, and isolated security patch files between them. Adobe has not published a general availability date for the next minor release on its lifecycle page. The latest patch release on each line, per Adobe's released-versions page:
| Line | Latest patch release | Released |
|---|---|---|
| 2.4.9 | 2.4.9 (no 2.4.9-p1 yet), plus the September and October 2026 isolated patches | 12 May 2026 |
| 2.4.8 | 2.4.8-p5, plus the September and October 2026 isolated patches | 12 May 2026 |
| 2.4.7 | 2.4.7-p10, plus the September and October 2026 isolated patches | 12 May 2026 |
| 2.4.6 | 2.4.6-p15 (final standard-support release). Adobe Commerce: plus the September and October 2026 isolated patches; Open Source downloads are 2.4.7 or later | 12 May 2026 |
The "Released" column is the date of the -p release. Since July 2026 Adobe has issued monthly isolated patches on top of it, which must be applied in release order: the most recent are September 2026 and October 2026. Adobe's October bulletin, APSB26-153 (13 October 2026), fixes 11 vulnerabilities, including a critical template engine injection flaw rated CVSS 10.0 (CVE-2026-103849), and Adobe says it is not aware of any exploits in the wild. It also says the September hotfix for CVE-2026-75650 (VULN-39341, from APSB26-146) must still be applied separately. For how Adobe numbers releases, see our guide to Adobe Commerce release types.
What to do next, by version
- 2.4.9: nothing to upgrade. Apply the September and October 2026 isolated patches, in that order, and the VULN-39341 hotfix if you have not, and keep PHP on 8.5.
- 2.4.8: supported to 31 May 2028. Be on 2.4.8-p5 plus the September and October 2026 isolated patches and the VULN-39341 hotfix. Plan 2.4.9 for when your extensions support PHP 8.5, OpenSearch 3 and Valkey; our 2.4.9 hosting requirements guide lists what changes.
- 2.4.7: supported to 31 May 2027, about seven and a half months away. Until then, stay on 2.4.7-p10 plus the September and October 2026 isolated patches and the VULN-39341 hotfix. Start the extension audit now and book the upgrade for early 2027 at the latest, so it does not collide with peak trading or the deadline. Our 2.4.7 to 2.4.9 upgrade guide sets out what can change before the upgrade and what has to change with it.
- 2.4.6 on Magento Open Source: past standard support since 11 August 2026, with nothing further committed by Adobe. The fix is an upgrade, usually to 2.4.8, or to 2.4.9 where your extensions are ready. Until it lands, reduce exposure as described below.
- 2.4.6 on Adobe Commerce: extended support to 31 August 2027, security-only to 31 May 2028, Cloud enforcement from 1 June 2028. Plan the upgrade now rather than at the deadline: PHP 8.2 reaches end of life on 31 December 2026.
- 2.4.4 or 2.4.5: Open Source stores have been past standard support since 2025. Adobe Commerce stores are in the security-only period to 31 May 2027, with Cloud enforcement from 1 June 2027. Upgrade now; every routine Adobe bulletin since your line ended went to newer lines. See Magento upgrades and security patching for how an upgrade runs.
- 2.3 or Magento 1: Adobe has not issued patches for these lines in years and you cannot rely on any. This is a migration project, not an upgrade. Our free migration service, carried out with minimum downtime, covers the hosting side.
If you cannot upgrade yet: interim protection for an unsupported Magento store
Honest framing first. Nobody can make an unsupported Magento version fully secure, because fixes for the application itself come only from Adobe, and no amount of monitoring replaces a vendor patch. What the hosting layer can do is reduce the chance an attack succeeds and shorten the time to notice one that does, while the upgrade is planned and delivered. That is the proposition: less exposure, and a dated plan to get supported again.
For a store on an unsupported version, EveryHost can provide:
- Environment and security assessment: version, patch level, applied hotfixes, PHP and dependency versions against Adobe's system requirements
- Patch assessment: every patch and hotfix Adobe did release for your line, applied and verified (VULN-39341 was issued for Open Source 2.4.6, for example)
- Hosting-layer hardening: firewall, admin path and IP restrictions, PHP-FPM function restrictions, file permissions, rate limiting
- Attack monitoring: Sentinel watches web server and system logs for exploit attempts, scanners and brute force, and blocks abusive IPs at the firewall
- Malware and file integrity monitoring: scans for webshells, injected code and core file changes
- Backup and recovery planning: on-server backups on every plan, with the Bastion off-site vault as an add-on, so a compromise can be rolled back
- Extension review: which extensions have compatible releases for your target version and which need replacing
- Upgrade planning: a dated plan to 2.4.8 or 2.4.9, so the interim period has an end
Sentinel is EveryHost's security monitoring layer, included on every plan. It works at the server level, so it does not depend on the Magento version. It cannot patch the application, and we will not tell you it makes an end-of-life store safe. It gives our engineers early warning and a faster response while you get back onto a supported release. Our security page lists what is included and the recent vulnerabilities we have handled.
Magento upgrade service: a managed move to 2.4.8 or 2.4.9
A Magento version upgrade is application work and infrastructure work at the same time, and most upgrades stall on the infrastructure half: the production host cannot run the PHP version, does not offer OpenSearch 3, or will not change the cache backend. EveryHost engineers, who operate Magento infrastructure every day, manage the infrastructure and the overall upgrade project, working with your developer or agency on the application work. A managed upgrade covers:
- Audit of the existing environment and store
- Version and dependency assessment against Adobe's system requirements
- A staging environment on the target stack, built fresh rather than upgraded in place
- Extension and custom-code compatibility assessment with your development team or agency
- Move to a production-supported PHP version for the target Magento release
- Database changes (MariaDB or MySQL version moves)
- OpenSearch or Elasticsearch changes (OpenSearch 3 for 2.4.9)
- Redis to Valkey where the target version calls for it
- Security patching to the latest patch level plus current hotfixes
- Functional testing: checkout, payment methods, shipping, emails, admin workflows
- Performance checks on the upgraded staging environment before cutover
- Deployment and cutover with a tested rollback path (the old environment stays untouched)
- Post-upgrade monitoring through Sentinel and our engineers
Upgrading onto fresh infrastructure is the cleanest pattern we know: build the target stack on a new server, upgrade and test the store there as staging, then cut over. It is how our free migration, with minimum downtime, works when paired with an upgrade, and it is what our managed Magento 2 hosting and Adobe Commerce hosting are built around. If you are also choosing a host, our UK Magento hosting comparison sets out the differences. For the cutover itself, see how we use Magento maintenance mode during deployments.
Magento end of life: frequently asked questions
Sources
- Adobe Commerce software lifecycle policy (updated 18 September 2026): support phases, dates, PHP end-of-life table, Cloud enforcement summary.
- Adobe Commerce released versions (updated 12 August 2026): release and patch dates, end of regular support per line.
- Magento Open Source 2.4.9 release notes (updated 22 May 2026): evidence that Open Source releases track the same lines.
- Adobe Commerce patch release schedule (updated 19 August 2026): release cadence and patch types.
- Adobe Commerce system requirements (updated 18 September 2026): PHP, database, search and cache versions per release; MySQL 8.0 and Elasticsearch 7.17 end-of-support notes.
- Required actions and deadlines to secure Commerce environments (updated 18 September 2026): Adobe Commerce on Cloud enforcement deadlines.
- Adobe knowledge base: APSB26-146 / CVE-2026-75650 (updated 21 September 2026): affected versions, hotfix VULN-39341, exploitation statement.
- Adobe knowledge base: APSB26-138 September 2026 security update (updated 16 September 2026): isolated patches per line, Open Source download note.
- Adobe security bulletin APSB26-153 (13 October 2026): October 2026 isolated patches, CVE-2026-103849 (CVSS 10.0), no known exploits, APSB26-146 hotfix still required.
- Adobe knowledge base: APSB26-153 October 2026 security update (updated 15 October 2026): isolated patches per line, release-order rule, Open Source download note.
This page is reviewed against those Adobe pages and updated when they change. Reviewed 16 October 2026.
Not sure whether your Magento version is still supported?
Tell us your version and patch level and we will tell you plainly where you stand, what Adobe has issued for your line, and what an upgrade would involve for your store.