Magento Open Source and Adobe Commerce 2.4.9 are available since 12 May 2026 (beta1 on 10 March 2026). It is one of the deepest updates in years: it reworks the framework, the system requirements, payments and security. Here are the changes that matter for store owners.

A modernized framework

2.4.9 drops legacy components in favour of modern, well-maintained ones:

• Laminas MVC → native PHP MVC: fewer dependencies, leaner code.
• TinyMCE → HugeRTE: a new content editor.
• Zend_Cache → Symfony Cache: more robust cache handling.

New system requirements

Check your environment before upgrading — requirements have changed significantly.

• PHP 8.4 and 8.5 (PHP 8.2 is no longer supported).
• MySQL 8.4 LTS or MariaDB 11.4 LTS (MySQL 8.0 and MariaDB 10.6 support dropped).
• OpenSearch 3.x, with backward compatibility for 2.x.

Payments and checkout

New local payment methods arrive — BLIK (Poland), Pay Upon Invoice (Germany) and ELO cards — plus Google Pay card vaulting via Braintree: shoppers save a card in their account and reuse it at checkout.

Security

Security bulletin APSB26-05 fixes 17 vulnerabilities (7 critical). 2FA is simplified: you only need to set up one method. CAPTCHA now also covers REST and GraphQL APIs, closing a gap exploited by bots.

API and GraphQL

The clearCart mutation is now available in Magento Open Source too. Overall the release ships 501 fixes on Open Source (560 on Adobe Commerce).

Should you upgrade?

Yes: 2.4.9 is supported until roughly May 2029 and secures your store on a modern stack. The upgrade does require updating PHP, database and search engine, so plan it with a staging test first. Need help assessing the migration? The Shine Software team is here to help.