Magento 2 versions, patches and updates explained

Magento 2 gets a new minor version roughly once a year (2.4.8, 2.4.9) and, in between, patches with a -p suffix, such as 2.4.8-p5. A patch fixes bugs and security holes without changing your shop. Always install the latest patch for the version you are on, and plan the step to the next version in good time.

How do Magento 2 versions and releases work?

Every current Magento 2 version starts with 2.4. The third number is the minor release: 2.4.6, 2.4.7, 2.4.8, 2.4.9. Such a release brings new features, and often new demands on your server, such as a newer PHP version or a new version of your search engine.

According to Adobe's overview (as of October 2026), the releases appeared like this:

| Version | Released | Regular support until | |---|---|---| | 2.4.6 | March 14, 2023 | August 11, 2026 | | 2.4.7 | April 9, 2024 | May 31, 2027 | | 2.4.8 | April 8, 2025 | May 31, 2028 | | 2.4.9 | May 12, 2026 | May 31, 2029 |

Adobe supports every version from 2.4.4 onward for three years from its release date. For 2.4.6 and 2.4.7 a year of extended support comes on top at no extra cost (2.4.6 until August 31, 2027, 2.4.7 until May 31, 2028). After that you no longer get quality fixes and security patches for that line. Check the current table in the Adobe documentation for your own situation, because dates and exceptions change.

What is a Magento 2 patch, and what is a security patch?

A patch is a small release within one version line. You recognise it by the -p and a number: 2.4.7-p10 is the tenth patch for 2.4.7. According to Adobe, 2.4.8-p5 is the latest patch for 2.4.8, released on May 12, 2026. No patch is listed for 2.4.9 yet.

A Magento 2 security patch is a patch that closes vulnerabilities. A vulnerability is a flaw in the code that an attacker can abuse, for example to read data or to run their own code on your server. Adobe publishes the details per patch in a security bulletin. Adobe's own advice is clear: install the latest security patch for each release.

A patch does not add big new features. That makes the risk smaller than with a new minor version, but not zero. If your shop has many custom modules or integrations, even a small patch can break something. That is why you always test first.

Do I always need to move to the newest Magento 2.4.9 or 2.4.8?

No. I want to be honest about this: the newest version is not automatically the best choice for your shop. What counts is that you run a version Adobe still supports, with the latest patch on top.

• On 2.4.8 or 2.4.7 with the latest patch? There is no urgent rush. Plan the step to 2.4.9 calmly.
• On 2.4.6? According to Adobe, regular support ended on August 11, 2026. You are now in extended support until August 31, 2027. Not a panic, but the moment to make a plan.
• On 2.4.5 or older? Then extended support is over or nearly over as well. Deal with this now.

A new minor release is not free either. Adobe tests each version with specific combinations of PHP, database and search engine. For 2.4.8 the system requirements page lists PHP 8.4 and 8.3 and OpenSearch 3. So sometimes you have to adjust your server before the update can happen. That work is part of the update, even if no quote mentions it.

What happens if you fall behind on Magento 2 updates?

Three things, in order of severity.

Security. When Adobe publishes a patch, the bulletin states what was fixed. Attackers read it too. The longer you wait, the bigger the chance someone tries that hole on your shop. A hacked webshop means stolen customer data, a blocked payment module or a Google warning for your visitors.

Compatibility. Hosting, PHP and third-party modules move along. If you are two or three versions behind, the jump is bigger and more things break at once. One update at a time is almost always cheaper than one big catch-up.

Support. Once regular support ends, your version gets no more quality fixes and eventually no more security patches. You are stuck with a shop you can no longer keep safe.

A real example from my work: I work daily on a Magento 2 production shop with over 3,400 products and 328 active modules. On a shop like that you see what happens when security is not in order. There I fended off a scraper attack of 2.3 million search queries from 600,000 IP addresses. An updated shop does not prevent every attack, but you stop being an easy target.

How do you run a Magento 2 update safely?

This is the order I recommend, for a patch and for a new version.

1. Make a full backup of files and database, and check that you can restore it.
2. Work on a copy of your shop (a test environment) first, never directly on production.
3. Read Adobe's release notes and see which requirements change: PHP, database, search engine.
4. Check your modules. Every third-party module has to match the new version. With 328 active modules, this is most of the work.
5. Walk through the key routes by hand: search, product page, cart, checkout, payment, order confirmation, integrations.
6. Roll out at a quiet moment and keep watching the logs and orders afterwards.
7. Keep a way back ready, so you can switch back at once if it goes wrong.

For patch upgrades on production I work this way, and I roll out without taking the shop down. That needs a deployment method where visitors keep seeing the old version until the new one is ready. A maintenance page that stays up for long costs you orders. Exactly how that works depends on your hosting.

Rather not do this yourself? Have a look at my pages on Magento 2 upgrades and Magento maintenance. You get a fixed price up front, so you know where you stand.

When is a Magento 2 update not needed?

Sometimes the answer is: not now. If your shop runs a supported version, has the latest patch and everything works, you do not have to jump along every year. A minor release that only brings a new PHP version is no reason to hurry as long as your current PHP version is still safe.

On the other hand, a shop that barely sells anymore and needs an expensive maintenance routine may be better off on a lighter platform. My comparison is in Shopify or Magento. I would rather tell you that you do not need Magento than sell you a project that does not fit.

Frequently asked questions

How often are Magento 2 security patches released?

According to Adobe, a full security patch for all supported lines appears at least once a year (in May). In between, Adobe releases isolated security fixes, for example in July and August 2026, and sometimes an extra patch. Do not count on months of silence.

Is installing a patch the same as a Magento 2 update?

No. A patch (2.4.8-p5) stays within the same version and is usually small. An update to a new minor release (2.4.8 to 2.4.9) is bigger, may demand new server software and needs more testing. Both belong to maintenance.

Which Magento 2 version should I use now?

Use a version that Adobe still gives regular support, with the latest patch on top. According to Adobe's overview, in October 2026 that means 2.4.7, 2.4.8 and 2.4.9. 2.4.6 is in extended support. For a new shop, pick the newest supported release.

What does a Magento 2 update cost?

It depends on the number of modules, your customisations and your hosting. That is why I work with a fixed price up front, on request. Extra work beyond that is € 95 per hour in blocks of 15 minutes. Get in touch with your version number and I will tell you what is needed.