Is Magento end of life? What Adobe’s roadmap means for Open Source, Mage-OS and Adobe Commerce in 2026

The short answer

Adobe released Magento 2.4.9 on 12 May 2026 and plans to support it until 31 May 2029. Security bulletins keep coming every month: the latest one, APSB26-153, was published on 13 October 2026, and the October bulletin already lists a 2.4.10 alpha, so the next release line is in the works. A platform that gets a new release, monthly security fixes and a three-year support window is not end of life.

What is true is narrower and more useful. Magento 1 ended years ago. Older 2.4 release lines have run out of support. And Magento Open Source, the free edition, loses security patches earlier than Adobe Commerce does. If you searched for “magento end of life”, one of those three is probably the reason, usually delivered by a hosting provider, a security scanner or a replatforming pitch.

What has actually reached end of life

Magento 1: ended in June 2020

Adobe published the last security patches for Magento 1 in June 2020. Every vulnerability found since then stays open on a Magento 1 store, and card schemes warned at the time that running it puts PCI DSS compliance at risk. There is no version of “keeping Magento 1 safe” that I would sign off on in 2026. I worked with Magento 1 for years, including building the G2A.com marketplace, and most recently moved alena-firany.pl from Magento 1 to Magento 2 without stopping sales. It is a solvable migration, but it is overdue.

Older Magento 2.4 release lines

Every 2.4.x release line gets a fixed support window. These are the dates from Adobe’s lifecycle policy as published in October 2026, cross-checked against independent version trackers:

Adobe changes these pages from time to time, so check the policy itself before you plan a budget around a date. The pattern, though, is stable: one new release line a year, three years of regular support each.

The PHP underneath your store

Your PHP version can reach end of life before your Magento version does. PHP 8.1 stopped receiving security fixes on 31 December 2025, and PHP 8.2 follows on 31 December 2026. Adobe’s own lifecycle page now notes that PCI compliance is at risk for stores still running them. Plenty of 2.4.6 stores run on PHP 8.1 or 8.2, so for them the real deadline is the earlier of the two.

Open Source and Adobe Commerce are not on the same clock

This is the part most articles skip. Open Source and Adobe Commerce share the same release dates and the same end of regular support. After that they split. Extended support and the security-only period in the table above are for Adobe Commerce licence holders only. Magento Open Source gets nothing after regular support ends.

You can see it in the October 2026 bulletin. It lists Magento Open Source 2.4.6 among the affected versions, but the fixed Open Source versions start at 2.4.7, and Adobe’s patch article says plainly that Open Source merchants can only download patches for 2.4.7 or later. So if you run Open Source 2.4.6 today, your store is end of life in the only sense that matters: new vulnerabilities are published, and there is no official fix for your version.

Adobe Commerce customers on 2.4.6 still receive patches, paid for by the licence, but the runway is short. For Adobe Commerce on Cloud there is a harder edge: Adobe’s lifecycle page says that from 1 June 2027 it will no longer maintain Cloud environments running unsupported versions, and warns that such a storefront may go offline.

The practical rule I give clients: on Open Source, treat the end of regular support as your deadline. On Adobe Commerce, treat extended support as a buffer for a planned upgrade, not as a plan.

Where Adobe is taking the product

Adobe’s investment has visibly moved to the hosted side. At Adobe Summit 2025 it announced Adobe Commerce as a Cloud Service, a managed, versionless SaaS edition, together with Adobe Commerce Optimizer. The self-hosted 2.4 line now gets one full release a year, in spring, with a three-year support window, and security fixes in between.

Nothing Adobe has published so far sets an end date for self-hosted Magento Open Source. My reading, and it is an opinion, not an announcement: Open Source is not being shut down, but it is not where Adobe’s roadmap energy goes either. In practice the community, not Adobe, increasingly carries the open-source side forward. That is where Mage-OS comes in.

Mage-OS: the community distribution

Mage-OS is a distribution of Magento Open Source run by the Mage-OS Association, a community non-profit registered in Poland. It is the same codebase you know, packaged and maintained by the community, with its own releases and without licence fees. Mage-OS 3.0 came out in May 2026 on top of Magento Open Source 2.4.9.

What matters most for a merchant is security. Mage-OS ports Adobe’s security fixes into its own releases, usually within days. When Adobe shipped an emergency hotfix in September 2026 for a vulnerability already being exploited, Mage-OS followed with an emergency security release, and it ported the October patch the day after Adobe published it.

Two caveats. Mage-OS patches only its latest release branch, so it is an upgrade path, not a way to keep an old version alive: if you install it and then sit still, you are unpatched again within months. And it does not include the paid Adobe Commerce modules, such as Adobe’s B2B suite. If you rely on those, Mage-OS means replacing them first.

Where it fits well: Open Source stores that want a maintained, licence-free Magento with a community release rhythm, and Adobe Commerce stores that pay the licence but use little of what it adds. For the second group, a move to Mage-OS or Open Source can save the whole licence fee, and an audit tells you quickly whether you are in that group.

What to do, depending on where you are

You are still on Magento 1

Migrate, and make it this year’s project. The real choice is the target: Magento 2, Mage-OS or Shopify. A Magento 1 store has to be rebuilt either way, so it is the one moment when comparing platforms costs you almost nothing extra.

You run Open Source 2.4.6 or older

You are already unpatched. Upgrade to 2.4.8 or 2.4.9, or move to the current Mage-OS release, and do it now rather than after the next critical bulletin. Check your PHP version in the same step. Depending on the version gap and the number of extensions, this is usually a few weeks of work, most of it on staging.

You run Open Source 2.4.7

You have until 31 May 2027. Plan the upgrade for winter or early spring, not for May, when every agency is doing the same job for everyone else.

You run Adobe Commerce

Extended support buys you time, and your licence pays for it. Use the time to ask a cheaper question first: which Adobe Commerce features do you actually use? If the answer is “not many”, the next upgrade may be the right moment to leave the licence behind.

You are thinking about leaving Magento

That can be the right call, especially for direct-to-consumer brands with a simple catalogue. But “Magento is end of life” is not a reason on its own, because it is not true. Compare a costed plan for staying with a costed plan for moving, then decide.

What I would not do

• Replatform in a hurry because of a headline. A rushed migration costs more, in money and in SEO, than a planned upgrade.
• Stop installing security patches because “Magento is dying anyway”. Unpatched stores are how card skimmers get in, whatever platform you move to next year.
• Upgrade Magento and leave PHP, MySQL and OpenSearch behind. The stack has to move together.
• Treat Mage-OS as a way to avoid upgrading. It only helps if you keep it current.

Sources

• Adobe Commerce lifecycle policy (release and support dates, PHP notes, Cloud enforcement)
• Adobe security bulletin APSB26-153, 13 October 2026
• Adobe knowledge base: October 2026 patches (Open Source downloads from 2.4.7)
• Mage-OS releases