What Happens to Your Magento Store After End of Support?

Merchants ask us this on almost every call about an older store: "What happens to my website after the Magento end of life date?" And behind it there is usually a second question people are almost afraid to say out loud: "Is my store going to shut down?"

Let's answer that one first, because you deserve a straight answer. No. Your store will not shut down. Nothing turns off on EOL day. Adobe ended support for Adobe Commerce and Magento Open Source 2.4.5 and 2.4.6 on August 11, 2026, and every store on those versions kept right on selling the next morning.

So the scary version is wrong. But the comfortable version, "nothing really changes, ignore it," is wrong too. Here is what actually changes, in plain terms, and what your options look like. It applies whether you run Magento Open Source, Adobe Commerce, or a Mage-OS build.

Will my Magento store stop working after end of life?

No. End of support is not a kill switch. The store runs on your hosting, your code keeps executing, and customers can still check out. Adobe does not reach in and switch anything off.

There is one real exception. If Adobe hosts your store on Adobe Commerce on Cloud, there is now an enforced upgrade policy. Starting June 1, 2027, Adobe will no longer maintain Cloud environments running unsupported versions and reserves the right to decommission them. The enforcement date is June 1, 2027 for stores on 2.4.4 and 2.4.5, and June 1, 2028 for 2.4.6 and 2.4.7. Self-hosted stores have no such switch. Cloud merchants now have a hard date, not just a soft risk.

What actually ends is the flow of fixes. The site stays up. The safety net goes away.

What exactly ended on August 11, 2026?

Adobe's software lifecycle policy spells it out by edition:

• Magento Open Source 2.4.5 and 2.4.6: no more security patches or quality fixes at all. Open Source does not get extended support.
• Adobe Commerce 2.4.5: its extended support year ended August 11, 2026. A one-time security-only period provides limited, isolated security fixes until May 31, 2027. After that, nothing.
• Adobe Commerce 2.4.6: paying customers get extended support, quality and security patches included, until August 31, 2027 at no extra cost. Then security-only fixes until May 31, 2028.

Adobe's own wording on that security-only window is blunt: treat it as migration time, "not as a long-term support tier." It will not be extended.

For context, here is where the supported lines stand. 2.4.7 has standard support through May 31, 2027. 2.4.8 is supported through May 31, 2028. And 2.4.9, released May 12, 2026, is supported through May 31, 2029.

What does "no more security patches" actually mean?

It means every vulnerability found from now on stays open on your store. Permanently. There is no patch coming, ever, for a version Adobe no longer supports.

That matters more on Magento than on most software, because Magento is one of the most targeted ecommerce platforms there is. Stores hold card payment flows, customer accounts, and admin panels, and attackers scan for them at scale.

A recent example shows how fast it moves. In September 2025, Adobe shipped an emergency fix for a critical flaw nicknamed SessionReaper (CVE-2025-54236) that could hand control of a store to an unauthenticated attacker. About six weeks later, mass exploitation began. Security firm Sansec reported attack attempts against roughly half of all Magento stores within days, and estimated that 16 to 18 percent of stores ended up with at least one backdoor injected. Those were mostly stores that had a patch available and had not applied it yet.

Now picture that same week on a version with no patch coming at all. That is the EOL condition. The next SessionReaper-class bug gets found, supported stores get a fix on Adobe's patch day, and your store simply stays open to it. Attackers read the EOL calendar too. Unsupported versions become the soft targets.

Is it illegal to run an EOL Magento store?

No law prohibits it. But if you accept cards, you agreed to PCI DSS through your payment processor, and that is where EOL bites.

The current standard, PCI DSS v4.0.1, says in Requirement 6.3.3 that critical security patches must be installed within one month of release, and other applicable patches on a schedule you define. Here is the trap: on an end of life platform, patches for new flaws are never released. You cannot install what does not exist. A known critical vulnerability can sit on your store, unfixable, which makes your compliance paperwork very hard to complete honestly, whether that is a self-assessment questionnaire or a QSA audit.

The platform is not the only clock, either. Magento 2.4.5 runs on PHP 8.1, and PHP 8.1 reached its own end of life on December 31, 2025. Adobe's lifecycle documentation flags this itself: running Commerce on end of life PHP puts PCI compliance at risk. PHP 8.2, which 2.4.6 uses, follows on December 31, 2026.

So what are the real consequences? Practical ones. Your acquiring bank can raise fees, demand remediation, or in a bad case terminate your merchant account. And if you are breached while demonstrably out of compliance, the liability conversation gets much worse. Not jail. Real money.

How long do I have before things start to break?

Technically, a long time. Practically, the cost of waiting compounds every month:

• The PHP clock. PHP 8.1 is already end of life, and hosts eventually drop dead PHP versions from their platforms entirely.
• Extension drift. Extension vendors build and test against supported Magento lines. Fixes and new features in the modules you rely on will increasingly require 2.4.7 or newer.
• Integration drift. Payment providers, shipping carriers, and tax services keep moving. Their new modules and SDKs get tested on current versions, not yours.
• The upgrade itself grows. Moving from 2.4.5 to 2.4.8 already means jumping from PHP 8.1 to PHP 8.3 or 8.4, plus newer MySQL and OpenSearch. Every release line you skip adds another layer of compatibility work to the eventual project.

Nothing dramatic happens in month one. That is what makes it dangerous. It is quiet drift, until the day it is a breach, a dropped integration, or an upgrade quote twice the size it needed to be.

What are my options now?

Three honest paths.

Option 1: Upgrade in place to 2.4.8 or 2.4.9

For most stores this is the right answer. Either target works: 2.4.8 is supported through May 2028 and the extension ecosystem has fully caught up to it, while 2.4.9 buys you an extra year, through May 2029. We covered what the 2.4.8 line changes in what Magento 2.4.8 means for your business.

The project itself has a known shape: an audit of your extensions and customizations, the version bump (Composer packages, PHP, database, search engine), fixing what the audit surfaced, then real testing on a staging copy before cutover. It is weeks of work, not days, and the store keeps trading while it happens. If you want the stage-by-stage picture of what an engagement like this looks like, we wrote a full guide to navigating Adobe Commerce development services.

Option 2: Move to Mage-OS

Mage-OS is the community-run, nonprofit distribution of Magento Open Source. Same core, same extension ecosystem, upstream compatible. The project exists so the open source platform does not depend on one vendor's roadmap, and it has been shipping steadily: its releases track Adobe's security patch days closely, typically within days, and its current 3.x line is built on the Magento Open Source 2.4.9 codebase.

Be clear about what it is not. Mage-OS does not let you stay on 2.4.5. Moving to Mage-OS is the same upgrade project as option one; you just land on a base maintained by the community instead of packaged by Adobe. For Open Source merchants planning to stay open source for the long haul, it is a genuinely good destination, and the work to get there is nearly identical either way.

Option 3: Replatform

Sometimes EOL is simply the moment to admit the platform no longer fits. Maybe the business outgrew the build, or shrank until Magento is more machine than it needs. The options run from Adobe Commerce as a Cloud Service, the versionless SaaS edition Adobe launched in 2025 where Adobe applies updates for you (no more upgrade projects, in exchange for a subscription and less control), all the way to a different platform entirely.

One honest caution: replatforming almost always costs more than upgrading. Do it because the destination is right for the business, not to dodge one upgrade. If you are weighing platforms, that comparison is exactly what our platform and framework work covers.

What should I do this month if I'm on 2.4.5 or 2.4.6?

A calm, concrete list:

1. Confirm your version and edition. Run bin/magento --version, or check the admin footer. Open Source, Adobe Commerce, and Mage-OS have different dates, as covered above.
2. Apply every patch that does exist. EOL means no new patches. It does not excuse missing the ones Adobe already shipped, including the SessionReaper fix. Many compromised stores were simply behind.
3. Check your PHP version. If you are on PHP 8.1, your compliance exposure is already live, separate from Magento's own dates.
4. Get an upgrade scoped now, even if you schedule the work for next quarter. Scope depends on your extension count and customizations, and a real number beats a guess.
5. Tighten what you can in the meantime. A web application firewall, locked-down admin access, and file integrity monitoring narrow the window. They are not a substitute for patches, but they buy careful time.

Most of that list is ongoing care rather than a one-off project, which is exactly what a good support and maintenance team handles month to month.

Here is the honest summary. Your store did not stop working on August 11, and it is not going to. But the meter started running, and everything on the ladder above, patches, compliance, compatibility, upgrade cost, moves in one direction from here. If you are not sure which path fits, send us your version number and a note about what is customized, and we will tell you what we would do in your shoes.