Your current version is out of support
Standard support for Magento Open Source 2.4.6 ended on 11 August 2026...meaning Adobe no longer commits to security patches or fixes for the version your store runs, and any vulnerability found from now on stays open. The software underneath is ending too: 2.4.6-p15 runs on PHP 8.1 or 8.2 at most, and PHP 8.2 reaches end of life on 31 December 2026.
We recommend you approve the upgrade to Magento Open Source 2.4.9 now. We'd release it before the end of March 2027, after the December to January trading freeze. To be plain about timing: PHP 8.2 support will most likely end before that release, so your store would run on an unsupported PHP version for about three months. We'd schedule Honda first to keep that window as short as we can.
Why 2.4.9, and what it gives you
- Back onto patched software. This reduces security and PCI exposure.
- The longest supported runway available. 2.4.9 has standard support until 31 May 2029. A cheaper move to 2.4.8 would need another upgrade before May 2028.
- A supported server stack at the same time. PHP, the database, search and cache all move onto supported versions.
- Less technical debt. It clears out dependencies carried from 2023.
2.4.9 is a foundations release with few new merchant-facing features. We aren't selling it on new features or speed gains. The case for it is support and reduced exposure, and the benefits depend on how the store and server are configured.
What changes in 2.4.9
2.4.9 is the largest architectural change in the 2.4.x line. Three parts of the framework are replaced:
- Laminas MVC is replaced by Magento's own MVC.
- Zend Cache is replaced by Symfony Cache.
- The TinyMCE admin editor is replaced by HugeRTE.
Extensions and custom code that use Laminas or Zend Cache directly will break, so extension upgrades are the largest part of the work.
The server stack moves to Adobe's current requirements: PHP 8.5, MariaDB 12.3 (or MySQL 8.4), OpenSearch 3, Valkey 9, RabbitMQ 4.3, Varnish 8 and Composer 2.10.
Why this is a heavy upgrade
- Three release lines, from 2.4.6 to 2.4.9 (2.4.7, 2.4.8 and 2.4.9).
- PHP 8.2 to 8.5, three PHP versions in one step.
- The database moves to MariaDB 12.3.
- All three framework replacements above.
- 40 third-party extensions to upgrade and test.
Estimate
| Workstream | Hours |
|---|---|
| Planning and technical discovery | 21 |
| Magento core upgrade | 23 |
| Server platform upgrade | 29 |
| Custom code compatibility (provisional, see assumptions) | 20 |
| Theme compatibility | 32 |
| Third-party extension upgrades (40 extensions) | 156 |
| Functional and regression testing, including admin content editing | 36 |
| Mobile and responsive testing | 8 |
| Baseline speed check on key pages | 3 |
| User acceptance testing (UAT) support | 11 |
| Production deployment | 7 |
| Hypercare and monitoring after release | 10 |
| Project management and coordination | 36 |
| Subtotal | 392 |
| Contingency (15%) | 59 |
| Total | 451 |
Indicative timeline
| Stage | When |
|---|---|
| Approval | November 2026 |
| Technical discovery and code scan | Before the December trading freeze |
| Upgrade build and testing on a separate copy of the store | During and after the freeze (no changes to the live store) |
| UAT with your team | February to March 2027 |
| Release to the live store | Before the end of March 2027 |
| Hypercare | The weeks after release |
We'll confirm exact dates once discovery is done.
Assumptions
- We'll confirm the PHP and database versions your store actually runs during discovery.
- The custom code hours are provisional until we scan your custom code for Laminas and Zend Cache use. If the scan finds more, the contingency line covers it first.
- The work covers the upgrade only, with no new features. Any feature request found during discovery is quoted separately.
- The baseline speed check compares key pages before and after release. It isn't a full performance benchmarking report.
Exclusions
- Licence or renewal fees for third-party extensions.
- Replacing any extension that has no version compatible with 2.4.9. Discovery flags these early, and we quote each replacement as a variation.
- Fixing admin content that renders differently after the editor change, beyond the checks in testing.
- New features.
Risks
| Risk | Likelihood | Impact | How we reduce it |
|---|---|---|---|
| A vulnerability is exploited while the store runs unsupported 2.4.6 | Medium | High | Approve now. Keep the web application firewall and monitoring tight until release |
| PHP 8.2 reaches end of life (31 December 2026) before release | High | Medium | Honda goes first in our schedule to keep the gap short |
| An extension has no 2.4.9 version | Medium | Medium | Discovery flags it early. A replacement is quoted as a variation |
| Custom code breaks on the framework changes | Medium | Medium | Code scan in discovery, and the contingency line |
| Admin content renders differently after the editor change | Low | Low | Content editing checks in regression testing and UAT |
Next step
Approve the upgrade and we'll start discovery straight away, so the code scan and extension review are done before the December freeze.
Kind regards,
Josh Camp
Chief Executive Officer
PH +64-09-9722636
Email josh@magebinary.com
Web www.MageBinary.co.nz
11/145 Kitchener Rd, Milford, Auckland 0620
Appendix A: Extension list
Your store runs 40 third-party extensions. In discovery we record each one in the table below, with the version you run today, the version that supports 2.4.9, and what it needs.
| Extension | Current version | Target version for 2.4.9 | Action needed |
|---|---|---|---|
| Completed in discovery | Upgrade, replace, or remove |
Any extension with no 2.4.9 version is flagged here, and its replacement is quoted separately.