Magento 2.4.9 is now available, giving Adobe Commerce and Magento Open Source merchants a new long-term platform baseline. Oracle MySQL 8.0 reached End of Support on 30 April 2026, creating an important infrastructure consideration for merchants on older release lines. However, this did not mean Magento 2.4.6 immediately lost Adobe security coverage: Adobe Commerce 2.4.6 remained in standard support until 11 August 2026.
Magento 2.4.9 is also far more than a routine update. The release introduces major infrastructure, dependency and security changes, including full PHP 8.5 support, newer search and caching options, and further platform changes relevant to PCI DSS requirements. In this guide, we break down what has changed, the biggest risks to watch for, and how merchants should approach the upgrade safely.
Why 2.4.9 matters
Magento 2.4.9 is not a routine patch release. It is a significant platform update, with Adobe documenting hundreds of fixes across Magento Open Source and Adobe Commerce alongside substantial changes to PHP, framework dependencies, search, caching and development tooling.
The scale of the release has real operational implications for merchants. From PHP 8.5 support and newer Valkey compatibility to PCI-related platform improvements, 2.4.9 introduces changes that can directly affect hosting environments, extension compatibility and long-term platform maintenance.
PHP 8.4 and 8.5 support
Magento 2.4.9 fully supports PHP 8.5. Adobe permits PHP 8.4 for upgrade purposes, but does not recommend it for production on 2.4.9. PHP 8.2 and PHP 8.3 are no longer supported on this release.
This is one of the most consequential infrastructure changes in 2.4.9 because merchants need to ensure that hosting, custom code, extensions and deployment tooling are compatible with the newer PHP requirements.
What you should do
Before scheduling your upgrade, confirm your hosting environment is ready for PHP 8.5. If you are on managed hosting, check with your provider that the required PHP version is available and fully supported on your plan.
If you are self-hosted, set up a staging environment running the target PHP version and test custom modules, Composer dependencies and integrations before touching production.
Extensions that rely on older PHP versions or incompatible dependencies may require updates, but a lack of published 2.4.9 guidance does not automatically mean an extension will break. Where compatibility is unclear, confirm it with the vendor or test the extension in staging.
Valkey caching support
Magento 2.4.9 continues Adobe’s support for Valkey, the open-source Redis-compatible caching technology that emerged following changes to Redis licensing. Valkey support predates 2.4.9, so this release should not be treated as its introduction to the Magento stack.
For merchants, Valkey provides another supported caching option alongside Redis. The practical value depends on the store’s hosting architecture, operational requirements and infrastructure roadmap rather than the Magento upgrade alone.
What you should do
If you are currently running Redis, there is no immediate requirement to switch simply because you are upgrading to 2.4.9.
However, if you are evaluating infrastructure costs, planning a hosting migration or reviewing your caching stack, Valkey may be worth assessing as an alternative.
Set up a staging environment with Valkey, benchmark it against your current Redis configuration, and review cache behaviour, sessions, deployment processes and monitoring before making a production change.
Security improvements
Security and platform hardening remain important parts of Magento 2.4.9.
Adobe released APSB26-49 alongside 2.4.9 on 12 May 2026, addressing vulnerabilities across supported Adobe Commerce and Magento Open Source release lines.
The 2.4.9 release also includes platform changes relevant to modern security and compliance requirements, including improvements around Subresource Integrity and configurable Admin password requirements.
However, upgrading to Magento 2.4.9 does not by itself make a merchant PCI DSS 4.0 compliant. Compliance depends on the wider payment environment, configuration, processes, integrations and service providers.
What you should do
If your store handles payments, review the security and compliance implications of the upgrade alongside your wider PCI DSS responsibilities.
Merchants on older Magento or Adobe Commerce versions should check both their current platform support status and the latest applicable Adobe security updates rather than assuming that moving to 2.4.9 is the only route to remaining secure.
Review the official PCI DSS requirements against your current setup to identify any outstanding gaps. If you are unsure where your store stands on PCI DSS compliance, consult your payment provider or a qualified security assessor before scheduling the migration.
Third-party compatibility: themes and extensions
Core platform compatibility is only one part of a Magento upgrade.
Themes, extensions, custom modules and integrations can all depend on PHP versions, framework packages, APIs or infrastructure components that change between releases. These dependencies deserve dedicated review before a production upgrade.
Hyvä themes
For merchants running Hyvä, compatibility with 2.4.9 is an important checkpoint before proceeding.
Hyvä released Theme 1.4.6 on 12 May 2026 specifically to provide compatibility with Magento 2.4.9 and PHP 8.5. The functional changes were made in the hyva-themes/magento2-theme-module package, while the Default Theme and Default Theme CSP packages had no functional changes in that release.
Before upgrading, confirm that your installed Hyvä Theme version and any compatibility modules used by the project support your target Magento and PHP versions.
Hyvä Checkout follows its own release and compatibility path, so merchants using it should check that separately rather than assuming Theme compatibility automatically covers the checkout layer.
Extensions
Create a full inventory of every installed extension and check each vendor's 2.4.9 compatibility status before proceeding.
Pay particular attention to:
-
payment gateways, because issues can directly affect checkout and payment processing
-
search integrations, particularly ElasticSuite or third-party search providers with deep indexing hooks
-
ERP and PIM connectors, which often integrate closely with Magento catalogue, inventory and order workflows
Contact vendors directly if their public documentation does not confirm 2.4.9 compatibility. Do not assume silence means compatibility, but equally do not assume an extension is incompatible without testing or vendor confirmation.
The upgrade timeline
There is no universal Magento 2.4.9 upgrade timetable. The right schedule depends on the complexity of your implementation, the number of integrations and how much testing your release process requires.
The following provides a practical example of how teams could structure the work.
Week 1 (12 to 18 May) - Discovery and audit
Review the full GA release notes, complete your extension and theme compatibility inventory, and identify any third parties that have not yet confirmed 2.4.9 support.
Flag dependencies that require direct vendor follow-up or additional testing.
Weeks 2 to 3 - Staging and compatibility testing
Set up a staging environment running 2.4.9 and the supported PHP version you intend to use in production.
Run your extension suite and critical integrations against it, resolve identified compatibility issues and document any changes required.
Do not proceed to production until the key customer and operational workflows are stable.
Week 4 - Performance testing
Test the staging environment against your current production baseline.
Look specifically for regressions in:
-
page load times
-
checkout behaviour
-
search and indexing
-
queue processing
-
cron
-
API and integration performance
Do not assume that the newer PHP, framework or infrastructure stack will automatically make every store faster. Benchmark the areas that matter to your implementation.
Week 5 onwards - Production upgrade
Schedule the production upgrade during an appropriate maintenance window for your business.
Ensure your rollback plan has been tested and is ready to execute, not just documented.
After go-live, monitor application errors, checkout and payment failures, indexers, queues, cron and third-party integrations closely during the initial post-deployment period.
On Tap's take
On Tap is a Magento specialist agency with experience delivering complex Adobe Commerce upgrades across multiple industries.
Magento 2.4.9 is a significant technical release. It introduces a newer PHP baseline, modernises several framework dependencies and gives merchants a longer-supported platform version for future development and maintenance.
For merchants already committed to Magento or Adobe Commerce, that makes 2.4.9 an important release to include in long-term platform planning.
That does not mean every merchant needs to upgrade immediately, nor does the release remove the need to consider other platform options where business requirements justify them.
The quality of the upgrade experience will depend heavily on planning, compatibility testing and the specifics of the existing implementation. Themes, extensions, custom code, integrations and infrastructure should all be assessed as part of the same upgrade programme.
Ready to upgrade?
On Tap offers a structured compatibility assessment covering your extension stack, hosting environment and theme compatibility.
Get in touch with our team to receive a prioritised action list and a realistic upgrade roadmap tailored to your store.
