Adobe Commerce 2.4.8-p5

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. PHP 8.4128 lines · 4.4K tokens
  2. Adobe Commerce 2.4.8-p581 lines · 4K tokens
Total209 lines · 8.5K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 95
  • 98
  • 117
  • 187
  • 201
  • 208
  • 209
  • 214
  • 250
  • 256
  • 294
  • 295
  • 306
  • 307
  • 308
  • 319
  • 323
  • 338
  • 340
  • 347
  • 352
  • 354
  • 359
  • 367
  • 384
  • 390
  • 409
  • 425
  • 434
  • 470
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 639
  • 640
  • 674
  • 675
  • 732
  • 770
  • 776
  • 798
  • 807
  • 829
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 940
  • 942
  • 1004
  • 1275
  • 1287
  • 1333
  • 1336
  • 1395

Prompt Preview

Apply the PHP 8.4 baseline first. These rules cover Adobe Commerce 2.4.8-p5 on PHP 8.4; Adobe also tests PHP 8.3 for this package. Standard support for the Commerce line ends on 31 May 2028. The Composer package version alone does not establish that subsequent isolated security patches are installed.

Release-line patching

  • Keep the Composer base on the newest 2.4.8 security patch release (-pN) that Adobe's released-versions page lists before applying this line's isolated patches, because Adobe tests them only against that release, and update installed B2B packages to the compatible security patch level required by the release notes.
  • On 2.4.8-p5, apply the July, August APSB26-92, and September APSB26-138 isolated updates in chronological order; a later -pN release folds them in, so never apply them over one. These files are non-cumulative. Within each month, apply CE before EE and then matching B2B files when present; include every applicable installed component, including Page Builder, using its own version and archive instructions.
  • On Cloud, update magento/magento-cloud-patches and verify which fixes it supplies before adding manual files; applying an isolated patch over an equivalent installed Cloud fix can fail.
  • Apply the separate APSB26-146 hotfix for CVE-2026-75650, which Adobe reports as actively exploited; the September monthly update does not replace it. Use the VULN-39341 hotfix variant listed for 2.4.8-p5 and complete the prescribed encryption-key and credential rotation after patching.
  • Verify monthly coverage with the Commerce Version Tool at