Adobe Commerce 2.4.4-p18

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. PHP 8.1.34198 lines · 8.1K tokens
  2. Adobe Commerce 2.4.4-p18105 lines · 4.7K tokens
Total303 lines · 12.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 95
  • 98
  • 113
  • 117
  • 187
  • 197
  • 201
  • 203
  • 208
  • 209
  • 214
  • 250
  • 256
  • 287
  • 294
  • 295
  • 306
  • 307
  • 308
  • 319
  • 327
  • 328
  • 338
  • 340
  • 347
  • 352
  • 354
  • 359
  • 362
  • 367
  • 377
  • 384
  • 409
  • 425
  • 434
  • 470
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 627
  • 639
  • 640
  • 674
  • 732
  • 759
  • 760
  • 770
  • 776
  • 778
  • 798
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1021
  • 1275
  • 1287
  • 1333
  • 1336
  • 1395

Prompt Preview

Apply the PHP 8.1.34 baseline first. These rules cover Adobe Commerce 2.4.4-p18 on-premises or on Cloud infrastructure, including the separately applied security fixes below. PHP 8.1 is the only runtime in Adobe's p18 compatibility matrix; its upstream end of life is not extended by Commerce support. The 2.4.4 line receives limited security-only fixes through 31 May 2027, after standard support ended on 12 April 2025 and extended support ended on 14 April 2026. These Commerce fixes do not extend Magento Open Source 2.4.4 support.

Release scope and required security fixes

  • Keep the Composer base on the newest 2.4.4 security patch release (-pN) that Adobe's released-versions page lists, because Adobe tests isolated security patches only against that release and requires it before you apply them; the package version alone does not establish that the installation is patched.
  • Apply the APSB26-146 hotfix for CVE-2026-75650 immediately: it addresses unauthenticated template-engine code execution exploited in the wild. Use the p18-compatible VULN-39341-composer-patches.zip; the September monthly patch does not contain this hotfix, and it may be applied before or after that monthly patch.
  • After installing the hotfix, follow its remediation procedure to rotate the Commerce encryption key and exposed credentials at their source: Admin passwords, integration tokens and OAuth secrets, payment/shipping/tax API credentials, database and Fastly credentials, SSH/deploy keys, and privileged automation credentials. Re-encrypting stored secrets does not revoke credentials