How Magento security patches arrive now, and what skipping one costs

If your Magento patching routine was designed around the old quarterly release train, it is now aimed at a schedule Adobe no longer follows. There is one full release a year, security-only releases a few times a year, and, since this year, the most urgent fixes ship as standalone patch files that never appear in Composer at all. A process that waits for composer update to surface security work misses exactly the fixes with a deadline measured in days.

Each vendor fact below links to the vendor’s own page and was checked on 17 July 2026.

The channels a fix can arrive through

Adobe’s published release schedule commits to one full patch release for the 2.4.x line each year, in May, and to security patches “at minimum annually” for every supported line. Practice runs well ahead of that minimum, and the recent security releases have landed on the second Tuesday of a month: the emergency SessionReaper fix on 9 September 2025, its scheduled follow-up on 14 October 2025, the 2.4.9 release with a security batch for the older lines on 12 May 2026, and the current bulletin, APSB26-73, on 14 July 2026.

Four kinds of artifact carry the fixes (release policy):

• Full patch releases, such as 2.4.9: one a year, carrying security work alongside quality fixes and platform compatibility. Adobe’s release notes for 2.4.9 count 580 fixed core issues, which is the honest measure of how much testing one demands.
• Security patch releases, the -pN versions: cumulative, security-only updates on top of your line’s last full release, so a shop can take the security fixes without the feature payload (security patch overview).
• Isolated patches: standalone, non-cumulative files fixing one or a few vulnerabilities. Two properties matter operationally. They apply only on top of your line’s latest -pN release, and they are not Composer packages: the July 2026 fixes shipped as downloadable patch files only, with no Composer release alongside them (Adobe’s APSB26-73 notice).
• Hotfixes for critical issues, outside any schedule.

Isolated patches are the piece existing processes miss. A pipeline that patches by raising the Composer version constraint sees full releases and -pN releases and nothing else, and Adobe now routes the most time-critical fixes around it.

The support clock per line

Every line receives security fixes for three years from its release date, per Adobe’s lifecycle policy. The dates, as that page states them today:

Line	Released	Security fixes end
2.4.9	12 May 2026	31 May 2029
2.4.8	8 April 2025	31 May 2028
2.4.7	9 April 2024	31 May 2027
2.4.6	14 March 2023	11 August 2026

Adobe does advertise extended support beyond these dates, and the fine print matters: extended support security patches “are available to Adobe Commerce customers only. They are not available for the Magento Open Source code base” (release policy). For a Magento Open Source shop the table above is the whole story. Against today’s date, a shop on 2.4.6 has until 11 August 2026, and a shop on 2.4.5 or older is already receiving nothing.

What a delay costs, with dates

The current reference case is SessionReaper, CVE-2025-54236: an unauthenticated vulnerability rated CVSS 9.1 and affecting every supported line (APSB25-88). Adobe published an emergency fix on 9 September 2025, as an isolated hotfix outside the schedule, and deployed WAF rules in front of Commerce Cloud stores (Adobe’s advisory).

Mass exploitation began on 22 October 2025, six weeks later. That day, Sansec’s scans still found 62% of Magento stores unprotected; two days on, Adobe raised the bulletin’s priority to its highest rating, the one that means patch within 72 hours. The previous year ran the same shape faster: merchants who applied the June 2024 CosmicSting patch more than two weeks late had their cryptographic keys stolen, which Sansec confirmed on more than 4,200 stores.

Sansec’s explanation for the urgency is that attackers reverse-engineer each patch on the day it ships: the fix documents the vulnerability. SessionReaper’s grace period was six weeks; CosmicSting’s was two.

The routine that matches the calendar

Kept up with, the cadence above is small, scheduled work.

• Watch the security bulletins rather than the package feed. Adobe announces isolated patches there; they do not appear in Composer.
• Stay on your line’s latest -pN. Isolated patches require it, so falling one security release behind also delays the next emergency fix until you catch up.
• Budget the May full release as a yearly upgrade. It moves PHP and dependency versions and touches extensions. The -pN and isolated patches between Mays are hours of work on a well-kept codebase.
• Plan the line upgrade against the three-year clock rather than waiting for a feature reason. The table above already names the quarter by which your next upgrade must land.

Running Mage-OS changes who packages the fixes, and keeps the routine. The association supports its latest release branch only and typically publishes within days of each Adobe release; its 3.2.0 security release shipped on 14 July 2026, the same day as Adobe’s bulletin, porting the isolated patch into the distribution’s source (Mage-OS releases).

This routine is part of the long-term operational support described on our Magento service page. If nobody at your company can currently say which -pN your shop runs, or the date its line stops receiving fixes, that is worth a short conversation.