Magento 2.4.7 end of life and Adobe Commerce Cloud's deadlines: your options

The short answer

• Magento Open Source 2.4.7 gets Adobe's security patches until 31 May 2027, and no longer. Open Source has no extended support, so 2.4.6 Open Source has had no patches since 11 August 2026, and 2.4.4 and 2.4.5 none since 2025.
• Adobe Commerce 2.4.7 (the paid edition) has extended support until 31 May 2028.
• Adobe Commerce on Cloud: from 1 June 2027, Adobe may suspend traffic to Cloud environments still on 2.4.4 or 2.4.5. Environments on 2.4.6 or 2.4.7 face the same from 1 June 2028.
• PHP comes first. PHP 8.2's security support ends on 31 December 2026. 2.4.6 runs only on PHP 8.1 and 8.2, and 8.1 is already past its end.
• Your options: upgrade to 2.4.8 (supported until 31 May 2028) or 2.4.9 (until 31 May 2029) where you are; move to Adobe Commerce as a Cloud Service; move to a host that runs the 2.4.8 or 2.4.9 stack and upgrade as part of the move; or replatform.

Dates checked against Adobe's documentation on 7 November 2026.

The dates, version by version

Sources: Adobe's software lifecycle policy (updated 18 September 2026) and released versions page (updated 14 October 2026).

How to read it:

• Magento Open Source shares the code line, but Adobe's versioning policy says "Extended support security patches are available to Adobe Commerce customers only", not to the Magento Open Source code base. For Open Source, the regular-support date is the last date Adobe patches that release.
• The latest patch releases Adobe lists are 2.4.6-p15, 2.4.7-p10 and 2.4.8-p5, all dated 12 May 2026. 2.4.9 has no patch release yet, and 2.4.10 is at alpha (2.4.10-alpha1, 13 October 2026). Check the released-versions page for anything newer before you plan.
• Adobe's pages differ by a day on one date: the system requirements page gives 30 August 2027 for the end of 2.4.6 extended support, the lifecycle policy 31 August 2027. We use the lifecycle policy.

What it means for you

Magento Open Source, on any host

Nobody switches your store off. The risk is that it stops receiving security fixes:

• 2.4.4, 2.4.5 and 2.4.6: no Adobe patches now.
• 2.4.7: patches until 31 May 2027.
• 2.4.8 and 2.4.9: supported until 31 May 2028 and 31 May 2029.

If you take card payments, Adobe's own guidance on PHP 8.2 is to "plan upgrade or migration before the end of 2026 to maintain PCI compliance", and "PCI compliance is the merchant's responsibility to assess" (lifecycle policy).

Adobe Commerce on your own or a partner's servers

You keep security fixes for longer than Open Source: security-only fixes until 31 May 2027 for 2.4.4 and 2.4.5; extended support until 31 August 2027, then security-only fixes until 31 May 2028, for 2.4.6; extended support until 31 May 2028 for 2.4.7. Adobe's enforcement wording applies to its Cloud environments, not to servers you run. Your licence terms are between you and Adobe.

Adobe Commerce on Cloud

Adobe's lifecycle policy says: "Starting June 1, 2027, Adobe will no longer maintain Cloud environments running unsupported Commerce versions". That "includes suspending traffic to the affected infrastructure", and "as a result, your ecommerce storefront will go offline". If an environment stays non-compliant, Adobe "may terminate cloud services", and its hosted data "will be permanently deleted and cannot be restored".

The deadlines by version: 1 June 2027 for 2.4.4 and 2.4.5; 1 June 2028 for 2.4.6 and 2.4.7; not yet set for 2.4.8 and 2.4.9.

On Cloud, Adobe patches the servers, but under its shared responsibility model "applying patches is the merchant's responsibility", and you must keep PHP, MariaDB, Redis, OpenSearch and the other services on versions your Commerce release supports. Adobe calls Adobe Commerce as a Cloud Service "Adobe's recommended long-term destination for all Adobe Commerce on Cloud customers".

The deadline before the deadline: PHP and the rest of the stack

Several parts of a Magento stack reach their own end dates inside this window.

Sources: php.net supported versions and end-of-life branches; Adobe's system requirements, 2.4.9 release notes and upgrade prerequisites; Elastic's end-of-life dates; Vinyl Cache.

For the PHP side in detail, see our guide to PHP 8.2's end of life.

Your four options

1. Upgrade to 2.4.8 or 2.4.9 where you are

The upgrade is needed in every option except replatforming and Adobe Commerce as a Cloud Service. The question is which release.

Sources: Adobe's system requirements, released versions and 2.4.9 release notes, linked above.

Suits you if your extensions have 2.4.8 or 2.4.9 releases and your team or agency can run the upgrade. 2.4.8 is the smaller step and buys support until May 2028; 2.4.9 buys a year more, at the cost of more code change now.

2. Move to Adobe Commerce as a Cloud Service (ACCS)

What Adobe's overview (updated 20 October 2026) says:

• It is Adobe-managed SaaS, with "the latest security patches automatically applied for you". New releases go to your sandbox first, with "a 30-day period to evaluate", and then to production.
• "Adobe Commerce as a Cloud Service does not support Luma storefronts." The storefront is "fully headless", powered by Edge Delivery Services.
• Adobe's backward-compatibility promise covers customisations that follow its "API-first extensibility model" (App Builder, API Mesh, events and webhooks).
• It quotes "99.9% availability". The overview publishes no prices.

Trade-offs. You stop running upgrade projects, but you rebuild the storefront and move in-process PHP modules to the API-first model. Themes built for Luma, and PHP-rendered themes such as Hyvä, would not carry over as they are (our reading of Adobe's overview; confirm with Adobe). The overview describes no data-migration tooling.

Suits you if you are on Adobe Commerce, use the wider Adobe Experience Cloud, and were planning a storefront rebuild anyway.

3. Re-host on the 2.4.8 or 2.4.9 stack

Moving host does not remove the upgrade, but it is a good moment to do it: build the new environment on the target stack, rehearse the upgrade there, and switch over once.

• Magento Open Source. No licence fee. Leaving Adobe Commerce for Open Source means losing Commerce-only features, such as the B2B modules, plus database and code changes; agencies that do this report planning it around the Adobe renewal date. Adobe publishes no licence prices; one Adobe partner estimates Cloud licences from about USD 40,000 a year for stores under USD 1 million of annual sales (an estimate, not Adobe's figure).
• Mage-OS. "An upstream-compatible distribution built on top of Magento Open Source", which says it "maintains full database and API compatibility with Magento Open Source". Version 4.0.0 was released on 30 October 2026 (Mage-OS). Check its release and support policy before you rely on it.
• Adobe Commerce under a self-hosted licence. Licences are quoted by Adobe. Whether and how a Cloud contract can become a self-hosted licence, and at what price, is a question for Adobe or your Adobe partner. Ask before your renewal date.

Suits you if you want to keep your storefront and extensions, control your stack, and choose who supports it.

4. Replatform

Shopify, BigCommerce, WooCommerce and Shopware are all routes merchants take. Each is a rebuild of the store, not an upgrade. If you are going this way, the dates above tell you how long the current store keeps receiving fixes, and the PHP dates still apply until you switch.

The options side by side

Upgrade runbook: 2.4.7 to 2.4.8

Written for Magento Open Source on your own servers or a managed host. Adobe Commerce and Cloud differences follow. Run it on a copy of production first, never straight on the live store.

1. Take stock. On the server or in your project:

bin/magento --version                                   # installed release
php -v                                                  # CLI PHP; check PHP-FPM separately, it can differ
composer show magento/product-community-edition         # edition and exact patch level
bin/magento config:show catalog/search/engine           # should print "opensearch"
bin/magento module:status --enabled | grep -v '^Magento_'   # third-party modules
composer show --direct                                  # packages your project requires directly

List every third-party module with its vendor's 2.4.8 and PHP 8.3 or 8.4 support. On Adobe Commerce, Adobe's Upgrade Compatibility Tool (bin/uct) checks custom code against a target release; it "is available for Adobe Commerce instances only".

2. Back up and copy. Back up the database, app/etc/env.php, composer.json, composer.lock and media, and build a staging copy with customer data anonymised. For example:

mysqldump --single-transaction --routines --triggers <database> | gzip > pre-upgrade-$(date +%F).sql.gz

3. Get to the latest 2.4.7 patch first (2.4.7-p10 at the time of writing). require-commerce comes from Adobe's root update plugin, so install it first if composer list doesn't show the command. Use the same maintenance, cron and build steps as in steps 6 and 7:

composer require magento/composer-root-update-plugin ~2.0 --no-update   # only if require-commerce is missing
composer update
composer require-commerce magento/product-community-edition 2.4.7-p10 --no-update
composer update
bin/magento setup:upgrade

4. Move the stack to versions both releases support. Adobe's tables for the latest 2.4.7 and 2.4.8 patches share PHP 8.3, MariaDB 11.8, OpenSearch 3, Valkey 8.1, RabbitMQ 4.3 and Varnish 8. Change one service at a time and test between each. Adobe's upgrade prerequisites also require every table to use the DYNAMIC row format (not COMPACT) and the InnoDB storage engine (not MyISAM).

5. Point Magento at OpenSearch if it is not already:

bin/magento config:set catalog/search/engine opensearch
bin/magento config:set catalog/search/opensearch_server_hostname <opensearch-host>
bin/magento config:set catalog/search/opensearch_server_port 9200
bin/magento indexer:reindex catalogsearch_fulltext
bin/magento cache:clean

If these values are fixed in app/etc/env.php, change them there instead.

6. Upgrade the code, following Adobe's upgrade procedure:

bin/magento maintenance:enable
bin/magento cron:remove                     # stop cron so nothing runs mid-upgrade
bin/magento cron:run --group=consumers      # let queued messages finish
cp composer.json composer.json.bak

composer require magento/composer-root-update-plugin ~2.0 --no-update
composer update

composer require-commerce magento/product-community-edition 2.4.8-p5 --no-update --interactive-root-conflicts
composer update

rm -rf var/cache/* var/page_cache/* generated/code/*
bin/magento setup:upgrade

--interactive-root-conflicts lets you review values in your root composer.json that differ from the new release. Without it (or --force-root-updates), Composer "keeps the existing values that are in conflict and displays a warning message".

7. Build, clear caches and reopen (production mode):

bin/magento setup:di:compile
bin/magento setup:static-content:deploy en_GB en_US     # list your store's locales
bin/magento cache:flush                                  # also clears Valkey cache storage
bin/magento cron:install
bin/magento maintenance:disable
bin/magento --version

8. Regenerate the Varnish configuration and load it on your Varnish server:

bin/magento varnish:vcl:generate --export-version=7 --output-file=var/varnish.vcl

The Magento code base ships VCL templates for Varnish 4 to 7. Check with whoever runs your cache that the generated file works on the Varnish or Vinyl Cache version in use.

9. Check before you call it done: a real checkout with each payment method, search and layered navigation, bin/magento indexer:status, cron and queue consumers running, var/log/exception.log and var/log/system.log, and your integrations (ERP, feeds, email).

Adobe Commerce, self-hosted: use magento/product-enterprise-edition in steps 3 and 6, and upgrade B2B with composer require-commerce magento/extension-b2b <version> --no-update at the version Adobe lists for your release.

Adobe Commerce on Cloud: create a branch from Integration, and validate the upgrade in Integration or Staging before Production (Adobe's Cloud upgrade guide). If 2.4.8 is outside your current version constraint, change it:

composer require-commerce "magento/magento-cloud-metapackage":">=2.4.8 <2.4.9" --no-update
composer update
git add -A && git commit -m "Upgrade to 2.4.8" && git push origin <branch>

Set the PHP version in .magento.app.yaml and the MariaDB, OpenSearch, RabbitMQ and Valkey versions in .magento/services.yaml. On Pro, Adobe needs "at least two business days' notice, excluding weekends" for Production changes.

Decision checklist

1. Which edition and release are you on? (bin/magento --version, composer show.) Which PHP runs your site, not just your command line?
2. Are you on Adobe Commerce on Cloud? If so, when does your contract renew, and what notice does it need?
3. Do you use Commerce-only features, such as B2B? Leaving Adobe Commerce means replacing them.
4. Are your extensions ready for 2.4.8 or 2.4.9? Which have no maintained version?
5. Which storefront do you run: Luma, Hyvä, PWA Studio or headless? ACCS needs the headless storefront.
6. Who does this upgrade, and who does the next one? 2.4.8 support ends on 31 May 2028.
7. Where do your trading peaks fall? Plan the switch-over away from them.
8. Who assesses your PCI DSS compliance, and does your plan keep PHP and Magento supported throughout?

What to ask any host

• Which versions of PHP, MariaDB, OpenSearch, Valkey, Varnish (and which project: Vinyl Cache or Varnish Cache) and RabbitMQ do you run for 2.4.8, and for 2.4.9? Who patches each one?
• Do I get a staging copy to rehearse the upgrade, and a snapshot before it?
• Who runs the Magento upgrade itself: you, me or my agency?
• Who moves the store, what does it cost, and what is not moved (email, DNS, certificates)?
• Which part of PCI DSS do you cover, and which part stays with me?
• Where will my data be, and what are the contract term and the exit terms?
• When did you apply the critical PHP security releases of 21 October 2026?

How Corefinity fits

Corefinity runs fully managed hosting for WordPress, WooCommerce, Magento 2 and Laravel on Google Cloud, in London, Northern Virginia (Ashburn), the Netherlands and Sydney.

• The 2.4.8 stack, set up: new Magento sites start on Magento Open Source 2.4.8, with OpenSearch, RabbitMQ and Valkey set up, and Varnish for Magento 2.
• Rehearse the upgrade: every site has staging and production environments, with clones and push to live. Each site runs in its own container.
• A way back: backups (snapshots) every 6 hours by default, hourly if you choose, kept 30 days.
• Separately: encrypted offsite backups.
• People: 24/7 engineer support. Corefinity is ISO 27001 and ISO 9001 certified and PCI DSS compliant; your store's own PCI DSS assessment stays with you.
• The move: free migration on every plan, done by our engineers.
• Not sure where your store stands? Ask for a free Magento security audit.

Magento 2 on CoreStack, one fully managed site, starts at CS4 with a Medium staging environment: from £410 / €450 a month + VAT, or $480 a month. Magento's staging environment must be Medium or Large, so it is upsized at extra cost: that starting price is CS4 plus the Medium upsize. Billed monthly, with no minimum term and no setup fee.

More on Magento hosting at Corefinity, and on our approach to security.

Sources

All checked on 7 November 2026.

• Adobe, Software lifecycle policy (updated 18 September 2026)
• Adobe, Released versions (updated 14 October 2026)
• Adobe, Versioning policy (updated 14 October 2026)
• Adobe, System requirements (updated 13 October 2026)
• Adobe, Shared responsibility security and operational model
• Adobe, Adobe Commerce 2.4.9 release notes (updated 12 August 2026)
• Adobe, Upgrade prerequisites (updated 28 April 2026)
• Adobe, Perform an upgrade (updated 8 October 2026)
• Adobe, Upgrade Compatibility Tool overview (updated 8 October 2026)
• Adobe, Upgrade Commerce version on cloud infrastructure (updated 1 September 2026)
• Adobe, Adobe Commerce as a Cloud Service overview (updated 20 October 2026)
• PHP, Supported versions and Unsupported branches
• Elastic, Product end of life dates
• Vinyl Cache (formerly Varnish Cache)
• Magento 2 source, PageCache VCL templates
• Mage-OS Distribution
• Elogic, Magento pricing explained (updated 3 November 2026; a partner's estimate)
• Scandiweb, Downgrading Adobe Commerce to Magento Open Source (accessed 6 November 2026)