Magento End of Life and the Security Patch Treadmill: Why B2B Brands Are Migrating In 2026

On August 11, 2026, two support clocks ran out at once. Adobe Commerce 2.4.5 reached the end of its extended support, and 2.4.6, the version a large share of B2B stores actually run, exited standard support on the same day. If your operation is on either line, your store's relationship with Adobe changed this month, and the details are worth knowing precisely, because the policy that now governs your storefront includes, for cloud-hosted stores, a date on which Adobe will take it offline.

Quick answer: Adobe Commerce versions get three years of standard support from release, a possible year of extended support, and, for 2.4.4 through 2.4.6, a one-time "security-only" transitional period that Adobe itself describes as migration time, not a support tier. As of August 2026, 2.4.4 and 2.4.5 are past extended support entirely, and 2.4.6 has entered its final extended year. New in the policy: starting June 1, 2027, Adobe will suspend traffic to Commerce on Cloud environments running unsupported versions, meaning the storefront goes offline. The strategic tell is that Adobe's own recommended fix is moving to its SaaS platform to "eliminate recurring upgrade cycles," in other words, even Adobe now sells leaving the treadmill. The open question is only which platform you step off onto.

The Dates, From Adobe's Own Table

All of the following comes from Adobe's published Commerce lifecycle policy, which was updated on August 17, 2026, and is the document to bookmark if you own this risk.

Adobe Commerce 2.4.4 ended standard support in April 2025 and extended support on April 14, 2026. Version 2.4.5 ended standard support in August 2025 and extended support on August 11, 2026. Version 2.4.6 ended standard support on August 11, 2026, with extended support running to August 31, 2027. Version 2.4.7 has standard support until May 31, 2027, and 2.4.8 and 2.4.9, released in 2025 and 2026, carry standard support into 2028 and 2029.

Below extended support sits a tier worth reading carefully: the security-only transitional period, available one time only for 2.4.4, 2.4.5, and 2.4.6. It provides limited, isolated security fixes and no quality fixes, and Adobe's own guidance is unusually direct about what it is for: treat the security-only period as migration time, not as a long-term support tier. When a vendor labels its own support tier a countdown, believe it.

The older history is settled: Magento 1 support ended in June 2020, and Adobe's roadmap attention, as the Magento migration page covers in its own terms, follows enterprise retail rather than the B2B operators who lean hardest on ERP integration and wholesale workflows.

The New Part: Adobe Will Take Stores Offline

The 2026 policy update added something end-of-life announcements usually lack: enforcement. Starting June 1, 2027, Adobe will no longer maintain Cloud environments running unsupported Commerce versions and states it will suspend traffic to the affected infrastructure, with the plain-language consequence spelled out in the policy itself: your ecommerce storefront will go offline. Environments that remain non-compliant after traffic suspension can be decommissioned, with all data and assets permanently deleted.

For 2.4.4 and 2.4.5 on Cloud, that enforcement date is June 1, 2027. For 2.4.6 and 2.4.7, June 1, 2028. This applies to Adobe-hosted Cloud environments rather than self-hosted stores, but it changes the character of the decision for everyone: end of life stopped being a risk you carry quietly and became a date on a calendar with a consequence attached.

The PHP Problem Underneath

There is a second clock most end-of-life coverage skips, and Adobe's own policy now flags it. Adobe does not patch third-party dependencies, and PHP 8.1, used by the 2.4.4 through 2.4.6 lines, reached its end of life on December 31, 2025. Adobe's lifecycle page states the consequence plainly: running PHP 8.1 past end of life means PHP vulnerabilities may not receive fixes, which puts PCI compliance at risk. PHP 8.2 follows at the end of 2026, pulling 2.4.6 stores into the same exposure.

Compliance is the merchant's to assess with their own qualified security assessor, and that is exactly the point: an unsupported stack turns a routine PCI questionnaire into a conversation nobody enjoys, and the same is increasingly true of cyber-insurance renewals. The store can be running perfectly and still be failing on paper.

The Treadmill Was Running Before the Clock Ran Out

Here is the uncomfortable part for anyone hoping an upgrade resets the situation: the cost of staying current was the original problem. Inside support, the Magento patch cycle runs every four to six weeks, each round requiring staging and production deployments and regression testing your team owns. PHP upgrades periodically break custom modules, with a common remediation cost of two weeks or more of developer time. B2B operations feel all of it worse, because the custom modules are load-bearing, wholesale pricing, checkout logic, and above all the ERP integration, which on Magento is typically version-coupled custom code that every platform update puts at risk.

So the fork in the road is not "upgrade or migrate" in the way it first appears. Upgrading to 2.4.8 or 2.4.9 buys a supported window and re-enters the same cycle: the next patch cadence, the next PHP transition, the next extension compatibility pass, and for Cloud customers, now with enforcement dates attached. It is a legitimate choice, and it is a lease renewal on the treadmill, not an exit.

Even Adobe's Fix Is Leaving the Treadmill

The most telling paragraph in Adobe's lifecycle policy is its recommended path forward: migrate to Adobe Commerce as a Cloud Service, Adobe's SaaS platform, where Adobe manages infrastructure, patching, and upgrades automatically, the end-of-life situation does not recur, and, in Adobe's own words, you eliminate recurring upgrade cycles.

Read that as the strategic concession it is. The vendor that defined self-managed commerce infrastructure now recommends escaping self-managed commerce infrastructure. Once the destination is a managed SaaS platform either way, the evaluation opens up, and for mid-market B2B operations the comparison stops being "Magento versus leaving" and becomes which managed platform: Adobe's SaaS, or Shopify Plus with its native B2B feature set and flat fee. That is a financial and capability question with real numbers on both sides, the three-year cost of ownership math covers the financial half for the Shopify path, and the migration itself has a defined playbook for B2B operations rather than a leap of faith.

What to Do, by Version

On 2.4.4 or 2.4.5: you are past extended support and living on the security-only transition, the tier Adobe calls migration time. If you are on Cloud, June 1, 2027 is your enforcement date. Scope your move now, in either direction, because discovery, data migration, and ERP re-integration consume most of a year when done carefully.

On 2.4.6: extended support runs to August 31, 2027, which feels comfortable and is not: it is one budget cycle. Use the window to run the evaluation properly rather than to defer it, and factor the PHP 8.2 end-of-life at the end of 2026 into your PCI planning either way.

On 2.4.7 or newer: no emergency, and the right moment to decide on purpose rather than under a deadline, whether the next platform event finds you renewing the lease or already gone. Operations that do migrate should plan past launch day too, since the point of leaving maintenance behind is reinvesting that capacity in growth, which is its own discipline after go-live.

Uncap has been a Shopify Platinum Partner since 2013, with more than 380 B2B commerce projects delivered, and Magento migrations with full ERP continuity are a core capability. Talk to Our Experts if you want your version, hosting model, and enforcement dates mapped against a realistic migration timeline, that conversation is most useful before the calendar forces it.