Magento and Adobe Commerce: patching an online shop

Updated November 2026

Magento shops are a target because they handle card payments. If you run Magento Open Source or Adobe Commerce 2.4, do three things now. Move to the latest -p release of your line. Apply every monthly isolated security patch in order, up to the October 2026 one. And make sure the VULN-39341 hotfix for CVE-2026-75650 is installed, because that flaw has been exploited in the wild.

2.4.9Newest release line (May 12, 2026)
11CVEs fixed on October 13, 2026 (APSB26-153)
CVE-2026-75650Exploited; separate hotfix since September 7, 2026
2.4.7Oldest Open Source line still getting patches

What it is

Magento is a PHP e-commerce platform. Magento Open Source is the free edition. Adobe Commerce is the paid edition, run on your own servers or on Adobe's cloud. Both share the same core, so most bulletins cover both. A shop is a stack: Magento itself, third-party extensions, PHP, MySQL or MariaDB, OpenSearch, and often Redis and Varnish. Attackers who get in usually plant a card skimmer, a small script that copies payment details at checkout. Patch the whole stack and keep the extension list short.

Check the installed version

Run commands from the Magento root as the file system owner (here magento_user), never as root.

sudo -iu magento_user
cd /var/www/shop
bin/magento --version
composer show magento/product-community-edition | grep versions    # Open Source
composer show magento/product-enterprise-edition | grep versions   # Adobe Commerce
php vendor/bin/patch-status --version     # is the verification tool present?
php vendor/bin/patch-status               # which monthly patches are installed or missing

patch-status is Adobe's Commerce Verification Tool. It ships inside the July 2026 isolated patch, so if the command is missing, you have not applied that patch yet.

Supported versions

Magento 2.4 release lines, as of November 2026
Line	Latest full release	Adobe Commerce support	Open Source October fix
2.4.9	2.4.9 (May 12, 2026)	Until May 31, 2029	Yes
2.4.8	2.4.8-p5	Until May 31, 2028	Yes
2.4.7	2.4.7-p10	Until May 31, 2027, extended to May 31, 2028	Yes
2.4.6	2.4.6-p15	Standard ended Aug 11, 2026; extended to Aug 31, 2027; security fixes to May 31, 2028	No
2.4.5, 2.4.4	2.4.5-p17, 2.4.4-p18	Security fixes only, to May 31, 2027	No

Adobe's lifecycle policy is written for Adobe Commerce. For Open Source, the practical test is the security bulletin. The October 2026 bulletin lists fixes for Open Source 2.4.7, 2.4.8 and 2.4.9 only, and lists 2.4.6 as affected with no fix. Adobe says Open Source merchants can download patches only for 2.4.7 or later. So an Open Source shop on 2.4.6 or older should upgrade now. 2.4.10-alpha1 (October 13, 2026) is a preview, not for production.

Each line supports only certain PHP versions: 8.5 for 2.4.9, 8.3 and 8.4 for 2.4.8, 8.2 and 8.3 for 2.4.7, 8.1 and 8.2 for 2.4.6. Adobe notes that PHP 8.1 reached end of life on December 31, 2025, and 8.2 does on December 31, 2026. Adobe warns that PCI compliance (the card industry's security standard) is at risk on those PHP versions, and 2.4.6 supports nothing newer, so 2.4.6 shops need to move to a newer line. See PHP updates.

How Adobe ships fixes

Full patch releases: once a year, in May, as Composer packages (2.4.9, 2.4.8-p5, 2.4.7-p10 and so on, all on May 12, 2026).
Monthly isolated security patches: between those, as patch files only, named by month, for example 2.4.8-2026-oct. To apply them you must already be on the latest -p release of your line. Each month's file builds on the earlier ones, so apply them all, in release order.
Hotfixes for urgent issues, such as VULN-39341 for CVE-2026-75650 (APSB26-146). Adobe asks you to apply it in addition to the monthly patches.

No Linux distribution or BSD packages Magento. You install it with Composer from Adobe's repository, using your access keys. Your OS package manager still patches PHP, the database, OpenSearch, Redis and Varnish. Patch those too: see MySQL and MariaDB, Redis and Varnish.

Monthly patch files only apply cleanly on top of the latest -p release of your line.

Update now

Test on a staging copy first and take a full backup of code, database and media. Step 1 moves you to the latest -p release. This example is Open Source 2.4.8; Adobe Commerce uses magento/product-enterprise-edition. The require-commerce command comes from the magento/composer-root-update-plugin package (install it with composer require magento/composer-root-update-plugin ~2.0 --no-update and composer update).

bin/magento maintenance:enable             # shop goes offline
bin/magento cron:remove                    # stop Magento cron jobs
bin/magento cron:run --group=consumers     # drain the message queue
cp composer.json composer.json.bak
composer require-commerce magento/product-community-edition 2.4.8-p5 --no-update
composer update
rm -rf var/cache/* var/page_cache/* generated/code/*
bin/magento setup:upgrade
bin/magento deploy:mode:set production     # compiles code and static content
bin/magento cron:install
bin/magento maintenance:disable

Step 2: download the monthly isolated patch files and the hotfix from the Adobe knowledge base articles linked from each bulletin. Unzip them and apply only the files that match your installed components, oldest month first:

patch -p1 < <patch-name>.composer.patch   # repeat per file, oldest first; try -p2 if -p1 fails
bin/magento cache:flush

These patches change files under vendor/. Composer puts the original files back whenever it reinstalls a package. Keep the patch files in version control and apply them again after every composer install or update, or apply them through a Composer patches plugin. If you use Redis or Memcached for cache, flush it too. If Varnish caches full pages, restart or purge it (sudo systemctl restart varnish restarts the service). If you upgraded PHP, restart PHP-FPM.

Verify

bin/magento --version
php vendor/bin/patch-status                 # every monthly patch should be installed
bin/magento deploy:mode:show                # should say production

On Adobe Commerce cloud, Adobe's check for the hotfix is vendor/bin/magento-patches -n status | grep "39341\|Status", which should show "Applied". Then place a test order and check the checkout page for scripts you don't recognise.

If you were exposed to CVE-2026-75650. Applying the patch does not undo a break-in. Adobe advises rotating the encryption key and every credential the shop holds: admin passwords, integration and OAuth tokens, payment gateway keys, database, SSH and deploy keys, and shipping and tax API keys. Rotating the encryption key alone does not invalidate stolen credentials. See what to do when a website is hacked.

Where advisories appear

Adobe security bulletins and advisories: filter by Adobe Commerce. Each bulletin (for example APSB26-153) lists affected and fixed versions for Commerce, B2B and Open Source.
Adobe Security Notification Service: free email alerts.
The Released versions page on Experience League, and its knowledge base announcements for hotfixes.
Your extension vendors' changelogs, and our vulnerability pages.

Quick hardening tips

Remove extensions you don't use with composer remove and bin/magento setup:upgrade. Disabled modules still leave code on disk. Every extension is one more vendor whose patches you must track.
Run in production mode, with code directories read-only for the web server. After installation, only var, generated, pub/static and pub/media need web server write access.
Block PHP execution in pub/media and pub/static.
Use a non-default admin URL, keep the built-in admin two-factor authentication on, and allow the admin area only from known IP addresses.
Check the HTML head and footer settings and CMS blocks regularly for JavaScript you didn't add. Skimmers often hide there.
Watch file changes under app/, vendor/ and pub/ with a file integrity tool.
Plan line upgrades before standard support ends: May 31, 2027 for 2.4.7.