Magento 2.4.6 Lost Support in August: What Waiting Actually Costs

If your store runs Magento 2.4.6, it stopped receiving security patches on 11 August 2026. The one exception is Adobe Commerce, the paid edition, which gets one more year. Magento Open Source, the free edition, does not.

So the decision in front of you is about exposure, not features: how long you are willing to run a checkout that nobody will fix when the next hole is found, and what it costs to stop.

Who is out of support, and until when

Adobe gives every 2.4 release three years of standard support, then stops shipping patches for it. For 2.4.6 and 2.4.7 it adds one extra year, but its lifecycle policy grants that year to "Adobe Commerce customers" only.

Version	Standard support ended / ends	Adobe Commerce only, extended to
2.4.6	11 August 2026	31 August 2027
2.4.7	31 May 2027	31 May 2028
2.4.8	31 May 2028	–
2.4.9	31 May 2029	–

There is a second clock under the first, and it catches Adobe Commerce customers too. Magento 2.4.6 runs on PHP 8.1 or 8.2. PHP 8.1 stopped receiving security fixes on 25 November 2025, and PHP 8.2 stops on 31 December 2026. So even a licence holder using the extra year will spend most of it on a language version that no longer gets security fixes of its own. The extension buys time to plan the upgrade. It is not a place to stay.

What waiting has cost other stores

The usual argument for waiting is that nothing has gone wrong yet. The last two years of Magento security history say otherwise.

In June 2024 Adobe patched CosmicSting (CVE-2024-34102), a flaw that let attackers read files on the server, including the store's secret encryption key. Sansec, which monitors Magento stores, reported that by that autumn 5% of all Adobe Commerce and Magento stores had a payment skimmer on their checkout page: 4,275 stores, attacked by seven competing groups. Some of them had installed the patch. Patching did not invalidate keys that had already been stolen, so stores that skipped rotating the key stayed open.

In September 2025 Adobe shipped an emergency fix for SessionReaper (CVE-2025-54236), a critical flaw that could lead to remote code execution. Six weeks later, when attacks began, Sansec found 62% of Magento stores still unpatched.

Two things follow for a store deciding what to do about 2.4.6. The gap between a fix and mass exploitation is measured in weeks, not years. And on an unsupported version there is no fix to install when the next one arrives: you are in the 62% by default, with no way out except the upgrade you postponed.

The compliance side

If you take card payments, PCI DSS requirement 6.3.3 expects critical security patches to be installed within 30 days of release. Version 4.0.1 of the standard narrowed that to critical vulnerabilities only, but kept the deadline.

A store on an unsupported version cannot meet that requirement the ordinary way, because no patch will be released. That doesn't make you non-compliant overnight, and it isn't legal advice. It does mean that at your next assessment you will need to explain which compensating controls you rely on instead, and that conversation gets harder every month the version stays in place.

What the upgrade actually involves

The upgrade itself is rarely the expensive part. What makes it expensive is everything around the Magento code.

The infrastructure moves first. Magento 2.4.8 runs on PHP 8.3 or 8.4, and 2.4.9 only on PHP 8.5 with OpenSearch 3, so the hosting stack has to change along with the application. Then come extensions and integrations: Adobe's own guidance notes that Marketplace extensions and third-party integrations may be affected, and each one has to be checked, updated or replaced. A store with a handful of well-maintained extensions and a stock theme is a very different project from one with years of custom modules and a hand-built ERP sync.

That is also why the cost of waiting compounds. Adobe says plainly that regular updates take less overall effort than infrequent ones. A store that moves every release does a small upgrade each time. A store that skips two or three does all of them at once, under pressure, usually after something has already gone wrong.

Our view on the target: go to the newest release your extensions support. If everything you rely on runs on 2.4.9, that buys support until May 2029. If a critical extension isn't ready, 2.4.8 is a sound stop until May 2028, and the next step from there is smaller.

The options, honestly

Upgrade on Magento. For most stores this is the answer. It keeps your catalogue, customers, order history and integrations where they are.

Move to Mage-OS. Mage-OS is a community-maintained distribution of Magento Open Source that ships its own releases and security patches, with the aim of patching faster. It is currently based on Magento 2.4.9, so switching is itself an upgrade, not a way to stay on 2.4.6. It is worth considering if you would rather not depend on Adobe's release schedule for the free edition.

Replatform. If the upgrade estimate comes back close to the cost of moving, it is fair to ask whether Magento is still the right platform. That is a bigger decision with its own hidden costs; we compared the platforms in what Adobe Commerce, Shopify and BigCommerce actually cost.

Do nothing. A web application firewall and closer monitoring reduce risk while you plan. They buy time. They don't replace patches, and they don't help with the PHP version underneath.

Before you get an estimate

Four questions decide how big this job is:

1. Which edition are you on? Adobe Commerce gives you until 31 August 2027. Open Source gave you until 11 August 2026.
2. Which PHP version does the server run? If it is 8.1, the language itself is already out of security support.
3. How many extensions and custom modules does the store use, and who maintains them? This list drives the estimate more than anything else.
4. What sits around the store? ERP, PIM, payment and shipping integrations each need testing against the new version.

If you would rather work through this against your own store's extension list and integrations, talk to us.

---

Support dates verified against Adobe's software lifecycle policy and system requirements, and PHP dates against php.net, in September 2026. Incident figures from Sansec's reports on CosmicSting and SessionReaper; PCI DSS changes from the PCI Security Standards Council.

---

Originally published at zelpex.com.