Adobe Commerce 2.4.9

Last reviewed Oct 28, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. PHP 8.5145 lines · 5.4K tokens
  2. Adobe Commerce 2.4.972 lines · 4.3K tokens
Total217 lines · 9.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 98
  • 117
  • 187
  • 201
  • 208
  • 209
  • 214
  • 250
  • 256
  • 294
  • 295
  • 306
  • 307
  • 308
  • 319
  • 323
  • 338
  • 340
  • 347
  • 352
  • 354
  • 359
  • 367
  • 384
  • 390
  • 409
  • 425
  • 434
  • 470
  • 488
  • 494
  • 502
  • 521
  • 522
  • 524
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 639
  • 640
  • 674
  • 675
  • 732
  • 770
  • 776
  • 778
  • 798
  • 807
  • 829
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 940
  • 942
  • 1004
  • 1275
  • 1287
  • 1333
  • 1336
  • 1395

Prompt Preview

Apply the PHP 8.5 baseline first. These rules cover Adobe Commerce 2.4.9 on-premises and on Cloud infrastructure, including custom modules, themes, storefront and Admin controllers, REST/SOAP, GraphQL, and installed Commerce extensions. Use Commerce services and compatible data formats for Commerce-managed accounts, sessions, and encrypted fields.

Version and security maintenance

  • Run production on PHP 8.5; PHP 8.4 is an upgrade bridge only, and PHP 8.2/8.3 are unsupported for 2.4.9. Use Adobe's tested dependency combinations for the deployment type: Composer 2.10, OpenSearch 3, Valkey 9, RabbitMQ 4.3 or ActiveMQ Artemis 2. On-premises lists MariaDB 12.3 or MySQL 8.4; Cloud lists MariaDB 12.3 (recommended) or 11.8.
  • Keep 2.4.9 patched throughout its regular support window ending May 31, 2029; Commerce support does not extend the security lifetime of PHP, databases, brokers, or other dependencies.
  • For installations using isolated monthly patches, verify the complete chain in Adobe's published release order. For each month, apply the available files matching installed components, including CE before EE and matching B2B/Page Builder files where present. Verify coverage with the Commerce Version Tool; check existing magento/magento-cloud-patches coverage before applying duplicate fixes.
  • Apply the separate APSB26-146 hotfix for CVE-2026-75650 in addition to the monthly patches. After patching, follow Adobe's remediation procedure to rotate the encryption key, Admin passwords, integration tokens, and potentially exposed payment, OAuth, database, deployment, and