Upgrades and security
The store works. That doesn't mean it's safe
An unpatched Magento gives no sign at all. It runs normally right up to the day a critical vulnerability appears — and last time, 43 days passed between the fix being published and the first wave of attacks.
Out of support
- Magento 2.4.611 August 2026
- Magento 2.4.511 August 2026
- Magento 2.4.414 April 2026
If you're on one of these, you no longer receive security fixes from Adobe.
Where you are now
Find your version in the table below
It's at the very bottom of the admin panel, or from `bin/magento --version` on the server.
| Version | Released | Last patch | Supported until | Status |
|---|---|---|---|---|
| 2.4.9 | 12 May 2026 | current release | May 2029 | Supported |
| 2.4.8 | 8 April 2025 | 2.4.8-p5 (12 May 2026) | 11 April 2028 | Supported |
| 2.4.7 | 9 April 2024 | 2.4.7-p10 (12 May 2026) | 9 April 2027 | Supported |
| 2.4.6 | 14 March 2023 | 2.4.6-p15 (12 May 2026) | 11 August 2026 | ExpiredSupport has expired. You no longer receive security patches. |
| 2.4.5 | August 2022 | — | 11 August 2026 | ExpiredExtended support has expired. |
| 2.4.4 | April 2022 | — | 14 April 2026 | ExpiredExtended support has expired. |
Adobe maintains a provision of additional security fixes for 2.4.4 and 2.4.5 until May 2027. It does not replace ordinary support, and it does not cover dependencies that have gone out of support — the PHP version, for one.
Data verified on 12 August 2026, against Versions and support timetable — Adobe Commerce documentation and SessionReaper timeline — Sansec research.
Ce s-a întâmplat ultima dată
43 de zile între patch și primul val de atacuri
- 9 September 2025Adobe publishes the emergency patch
- 19 September 2025Fewer than one store in three is patched
- 22 October 2025The public analysis lands. Mass attacks begin
- 26 October 2025Attacks reach half of all Magento stores
- 1 November 2025Four in five stores visited by attackers
9 September 2025
Patch available
Day 0
Adobe publishes the emergency patch
APSB25-88, for CVE-2025-54236 — a deserialisation vulnerability in the REST API, scoring 9.1 on CVSS. It allows account takeover and remote code execution, without authentication. The public name: SessionReaper.
- 9 September 2025
- 19 September 2025
- 22 October 2025
- 26 October 2025
- 1 November 2025
Free check
Check your store now
We only read what your store already hands out to anyone, exactly the way an ordinary browser would. We test nothing and force nothing.
What we do, and what we don't
- We request the homepage, like any visitor.
- We read the response headers, the last publish date from the static file path, and the page's public source.
- We request a handful of addresses that shouldn't answer at all, listed here so you know exactly what we touch: /magento_version, /admin, /setup/, /pub/, /app/etc/env.php, /.git/config, /.env, /composer.json, /composer.lock, /phpinfo.php.
- We compare against the official release list in the Magento repository.
- We send no payloads, attempt no logins, enumerate no directories, and never test whether a vulnerability can actually be exploited.
- For a full official scan, Adobe provides its Security Scan Tool free of charge. We are not a replacement for it.
Your result appears here: which platform is running, when it was last published, which security headers are missing, which files are publicly downloadable, and — if you give us the version — exactly which patch you're missing.
Versions come from the official `magento/magento2` repository, refreshed daily.
And it wasn't the first time
CosmicSting CVE-2024-34102
A year earlier, an XXE vulnerability with the same profile — unauthenticated, remotely exploitable — led to 4,275 confirmed compromised stores, attributed to seven distinct attack groups. The pattern repeats: patch published, adoption slow, exploitation at scale.
How Adobe ships fixes
Three different rhythms, needing three different responses
Since January 2026, Adobe publishes isolated security fixes every month. That's good news — provided somebody actually applies them.
Isolated fixes, monthly
Since January 2026, Adobe has moved to isolated security fixes shipped monthly. They are smaller, more frequent and easier to apply than the aggregated patches that came before — but it also means the window in which you are behind opens every single month.
Aggregated patches, occasionally
On top of the monthly fixes, Adobe periodically publishes aggregated patches that bundle several fixes and sometimes behaviour changes. Those need testing, not just applying.
Major versions, annually
A new 2.4.x release usually arrives in spring. Each one starts a three-year support clock — after which the store gets no fixes at all, whatever turns up.
How we run an upgrade
Six stages, four of which happen before we touch production
The hard part of a Magento upgrade isn't the update command. It's the extensions, the custom code and the theme — everything added on top of the platform over the years.
Analysis
Which version you're on, and what's holding you there
We establish the exact version, the patch level and the extension inventory. The most common blocker on an upgrade isn't Magento — it's the three extensions with no build for the new version.
Plan
The route to a supported version
From 2.4.6 you can't jump straight anywhere. We set out the intermediate steps, which extensions get replaced, which custom code gets rewritten, and how long each stage takes.
Test environment
Nothing gets touched in production
The upgrade happens on a copy of the store, with the real data. That's where you find out what breaks — not on launch night with customers in the cart.
Testing
The flows that bring money, checked by hand
Search, filters, add to cart, checkout, payment, invoicing, the ERP and courier integrations. The list gets walked through manually, not assumed.
Launch
A switch with a way back
In a low-traffic window, with the old version ready to take over at any moment. No launch without a return route.
Afterwards
Monthly patches become routine
An upgrade solves today. What keeps you safe long-term is someone applying the fixes every month, on time.
What actually breaks
Four things that give way on almost any upgrade
We tell you beforehand, not mid-project. An upgrade without surprises doesn't mean nothing goes wrong — it means you knew about it in advance.
Extensions with no new build
The most common blocker. Some are no longer maintained at all. Each one gets a decision: update it, replace it, or rewrite the functionality.
Custom code over changed classes
Overrides and plugins that touch classes changed in the new version fail silently. They're found by testing, not by reading release notes.
The theme, if it's Luma
Overridden templates break at every version jump. On Hyvä the problem nearly disappears — one of the reasons we recommend migrating.
The stack underneath Magento
Each version wants different versions of PHP, MySQL, Elasticsearch or OpenSearch. A Magento upgrade is frequently a server upgrade too.
An upgrade solves today. What keeps you safe long-term is someone applying the monthly patches on time — which is part of the maintenance retainer.
See maintenanceFrequently asked
What merchants ask us about upgrades and security
If your question isn't here, call us. We answer the ones other agencies would rather avoid.
For critical vulnerabilities, in days — not weeks. With SessionReaper, 43 days passed between the patch being published and the first mass attacks. That sounds like plenty of time, but 62% of stores still hadn't applied it by then.
Not sure which version you're on?
Send us your store's address. We'll tell you which version you run, whether it's still supported, and what moving to a supported one would involve — no obligation.
- Phone
- 0723 296 296
- contact@vonteq.ro
- Offices
- Headquarters — Bucharest
Strada Samuil Vulcan 12D, Bucharest, RomaniaSales office — Dubai
46 Al Marsa St, Dubai, UAE