Magento 6 min read
How Magento releases work: new versions and patches for store owners
Adobe releases Magento on a calendar, but critical fixes also come outside it. What types of releases there are, what they mean for your store, and why the version number does not always tell the truth about how big the change is.
Adobe releases Magento on a calendar it publishes a full year ahead.[1] Once you know it, you know when to expect updates in your store, and you can plan campaigns and developer time around them.
Summary
- A new release (for example 2.4.9) comes out once a year. In 2026 it came out on May 12. It often brings new features and can cause compatibility issues.[1][5]
- Security patch releases (for example 2.4.8-p5) ship for all supported versions at once, in 2026 in March and May.[3]
- In between, isolated security patches come out, in 2026 every month from July.[1]
- Fixes for critical issues, such as so-called zero‑day vulnerabilities, come out as needed, outside the calendar too. Those need to go in right away.[2]
- Every version gets three years of support. After that, no more security fixes.[4]
As of October 15, 2026.
Why the version number does not tell the whole story
With a lot of software, the last number of a version means a small fix and the middle one means new features. This is called semantic versioning. Magento does not use it for its overall version number, only internally for the individual parts of the system.[2]
The 2 at the start has not changed in years, and neither has 2.4. Everything that matters happens in the third place. Going from 2.4.8 to 2.4.9 looks like a small step, but it is the biggest change Magento gets all year. Version 2.4.9, for example, dropped support for PHP 8.2 and 8.3, replaced the content editor and added new payment methods.[5] An update like that needs to be prepared and tested, not just installed.
Five types of releases
| Example | How often | What it means for you | |
|---|---|---|---|
| New release | 2.4.9 | Once a year, in 2026 May 12[1] | New features and newer technology. It can break modules and customizations, so it needs testing.[5] |
| Security patch release | 2.4.8-p5 | In 2026 March 10 and May 12[3] | All security fixes so far for your version, with no new features.[2] |
| Isolated security patch | a file for each supported version | In 2026 every month from July[1] | A quick fix for specific issues. It only applies on top of the latest security patch release.[2] |
| Hotfix | a fix for supported versions | Any time as needed, outside the calendar[2] | A fix for a critical flaw attackers can exploit. It goes in right away.[2] |
| Pre-release | 2.4.9-beta1, 2.4.10-alpha1 | A few months before a new release[1] | For developers and module authors. Not for a live store. |
Security patch releases and what -p means
The letter p with a number after the version marks a security patch release. 2.4.8-p5 is the fifth security patch release of 2.4.8.[2] Each one includes all the previous ones, so if you skip one, the next one catches you up.[2]
It adds no new features, so it is usually smaller and safer to apply than a new release. It is not risk-free, though. It can include changes required by law or for security that affect modules.[2]
Isolated security patches
When Adobe finds an issue between two patch releases, it does not wait for the next one. It ships a standalone file that fixes just that issue and nothing else.[2] In 2026 the calendar has one every month from July to October.[1] For Magento Open Source they only cover versions that are still supported, so from September that means 2.4.7 and newer.[6]
The catch is that they only apply on top of the latest security patch release of that version.[2] If you are behind, you have to catch up first.
Hotfixes outside the calendar
The calendar covers planned releases. When a critical flaw shows up that affects many stores, such as a so-called zero‑day vulnerability that attackers found out about before Adobe did, Adobe does not wait for the calendar. It ships a hotfix for supported versions as soon as it is ready.[2] A flaw like that can let an attacker into your store, so a hotfix goes in right away, even in November or just before the holidays.
November and December 2026
At the end of 2026 Adobe releases only optionally, because of the holiday season.[1] That makes sense. November and December are when most stores make the most money, and nobody wants to take risks. Whatever needs to go in is best done by the end of October. Hotfixes for critical flaws still go in during that time, though.
How long a version is supported
Every version gets three years of support from its release.[4] Once support ends, security fixes stop and the store gets more and more exposed. For Magento Open Source, this is where things stand as of October 15, 2026:
- 2.4.9: until May 31, 2029
- 2.4.8: until May 31, 2028
- 2.4.7: until May 31, 2027
- 2.4.6: support ended on August 11, 2026
- 2.4.4 and 2.4.5: unsupported since 2025[4]
The paid Adobe Commerce also gets extended support: 2.4.7 until May 31, 2028, 2.4.6 until August 31, 2027, and security fixes for 2.4.4 and 2.4.5 until May 31, 2027.[4] Those fixes are not available to download for Magento Open Source.[2][7]
The full month-by-month overview is in our Magento release schedule.
What to do now
- Find out which version your store runs. It is in the footer of the admin.
- Check that you have the latest security patch release for your version. For 2.4.8 that is 2.4.8-p5 as of October 15, 2026.[3]
- Find out whether you also have the latest isolated security patch applied. Check this with your developer.[2]
- On 2.4.6 or older? Plan the move to a newer version, support for Magento Open Source has already ended.[4]
- Agree with your developers who keeps track of releases, how fast they apply security fixes, and that they apply a hotfix as soon as it comes out.
- Plan big updates outside the season, in spring or summer. November is not the time.[1]
And on Deedhold?
We keep track of releases. Security patch releases and fixes go in as part of regular maintenance, and we try new versions in a test environment first. When Adobe ships an out-of-schedule fix for a critical flaw that attackers already exploit and that could let them take over the store, we apply it right away. How Deedhold works
Sources
- Release schedule, Adobe Commerce, Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)
- Adobe Commerce release policy, Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)
- Released versions, Adobe Commerce, Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)
- Software lifecycle policy, Adobe Commerce, Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)
- Adobe Commerce 2.4.9 release notes, Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)
- Security update available for Adobe Commerce - APSB26-136 (September 2026), Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)
- Security update available for Adobe Commerce - APSB26-92 (August 2026), Adobe Experience League: experienceleague.adobe.com (accessed October 15, 2026)