Adobe's extra year on Magento 2.4.6 runs mostly on an unsupported PHP

Count the extra year Adobe adds for 2.4.6 and 2.4.7. It starts on 11 August 2026 ^[1], and the lifecycle policy grants it to "Adobe Commerce customers" ^[3]. PHP 8.2 stops receiving security fixes on 31 December 2026 ^[6]. So roughly seven of those twelve months run on a language version that no longer gets fixes of its own ^[1]. Stores still on PHP 8.1 passed their own date on 25 November 2025 ^[5].

Sansec, which monitors Magento stores, found 62% of them still unpatched six weeks after Adobe's emergency fix for SessionReaper (CVE-2025-54236), the point at which attacks began ^[7][8]. PCI DSS requirement 6.3.3 expects critical security patches installed within 30 days of release, and version 4.0.1 of the standard narrowed the scope to critical vulnerabilities while keeping the deadline ^[9][10]. Six weeks is 42 days. That majority had missed the 30-day window by 12 days before the first attack landed ^[2].

CosmicSting (CVE-2024-34102), which Adobe patched in June 2024, let an attacker read files on the server, including the store's secret encryption key ^[12]. By that autumn Sansec counted payment skimmers on the checkout pages of 4,275 stores, 5% of the Adobe Commerce and Magento population, attacked by seven competing groups ^[13]. At that ratio the population is about 85,500 stores ^[3]. Some of the 4,275 had installed the patch. It did not invalidate keys stolen before it went on, so stores that skipped rotating the key stayed open ^[14].

Version targets come with server requirements. 2.4.8 runs on PHP 8.3 or 8.4, and 2.4.9 runs only on PHP 8.5 with OpenSearch 3 ^[15]. Adobe's guidance notes that Marketplace extensions and third-party integrations may be affected, and each one has to be checked, updated or replaced ^[16]. Zelpex, the agency that published the piece on dev.to, recommends going to the newest release the extensions support: 2.4.9, with support until May 2029, or 2.4.8 as a stop until May 2028 ^[18][17].

Mage-OS, a community-maintained distribution of Magento Open Source that ships its own releases and security patches, is currently based on 2.4.9, so moving to it is itself an upgrade ^[19]. The piece does not price any of the work. Its effort claim comes from Adobe, which says regular updates take less overall effort than infrequent ones ^[20].