Quick answer: On 13 October 2026, Adobe released security update APSB26-153 for Adobe Commerce and Magento Open Source, fixing 11 vulnerabilities rated critical, high and medium. Adobe also instructs merchants to apply a separate hotfix for CVE-2026-75650 (from the September bulletin APSB26-146) and strongly recommends rotating encryption keys and related credentials. If your store has not applied all of this, you should do it before Black Friday on 27 November. The safe sequence is to back up, test on staging, apply the October patch and the hotfix, verify the result with Adobe’s Commerce Version Tool, rotate your keys and credentials, check for signs of compromise, then deploy and monitor.
Why this matters right now
Black Friday, Cyber Monday and the Christmas period are when Australian stores take the most orders and carry the most risk. Attackers know it. A compromised Magento store at this time of year can mean stolen customer data, card-skimming scripts on checkout, a store taken offline during peak trading, and reputational damage that lasts long after the sale.
There are three reasons to treat this update as a priority:
- It is a large update. APSB26-153 addresses 11 vulnerabilities across critical, high and medium severity levels, and covers Adobe Commerce, Magento Open Source and Adobe Commerce B2B.
- It comes on top of a September problem. The CVE-2026-75650 hotfix from the earlier bulletin (APSB26-146, released 7 September 2026) is not optional. Adobe’s October guidance tells merchants to apply both.
- The deadline is close. Many compliance frameworks expect critical patches to be applied within about a month of release, which for an October 13 release points to mid-November, just before the sales period begins.
If you have already read our guides to the Magento 2.4.9 upgrade and Magento 2.4.5 and 2.4.6 end of support, think of this article as the short-term action plan. Upgrading is the long-term fix, but patching is what you need to do this month.
What Adobe released
| Item | Details |
|---|---|
| Bulletin | APSB26-153, released 13 October 2026 |
| Products | Adobe Commerce, Magento Open Source and Adobe Commerce B2B |
| Vulnerabilities fixed | 11, rated critical, high and medium |
| Updated versions listed | 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct, 2.4.6-2026-oct, 2.4.5-2026-oct and 2.4.4-2026-oct |
| Isolated patch files | Available for the 2.4.9 and 2.4.8-p5 release lines, with other lines covered by Adobe’s documentation |
| Separate hotfix | CVE-2026-75650 (from APSB26-146, 7 September 2026) |
| Extra recommendation | Rotate encryption keys and associated credentials |
The exact patch you need depends on your version and how your store is deployed, so always use Adobe’s official security bulletin and Experience League documentation as the source of truth. This table is a summary, not a replacement.
Is your store affected?
Adobe lists affected versions as those on the September 2026 patch level or earlier across the 2.4.4 to 2.4.9 release lines. In plain terms, you should assume your store is affected if:
- You run any Magento Open Source or Adobe Commerce 2.4.x store that has not applied the October 2026 patch.
- You have not applied the CVE-2026-75650 hotfix.
- You are not sure which patches have been applied, which is common if a previous agency or developer set up the store.
- You run Adobe Commerce B2B and have not checked its component versions.
This applies whether your store is on-premises, hosted by a third party or running on Adobe Commerce Cloud. Stores on older release lines should also review their support status, because patch availability and support terms differ by version. Our guide to Magento 2.4.5 and 2.4.6 end of support explains what that means in practice.
Step 1: Identify your version and patch level
Find your exact Magento or Adobe Commerce version and check which security patches are already installed. Adobe provides the Commerce Version Tool for this. It is installed at vendor/bin/patch-status, and it is introduced by the July 2026 Community Edition isolated patch. You can check whether it exists by running php vendor/bin/patch-status –version from your project root. If the command is not found, apply the July 2026 isolated patch for your release line first, then follow Adobe’s instructions to run the patch status report.
The report shows which patches are installed, which are missing and the vulnerability status of your store, so it is the quickest way to find gaps.
Step 2: Take a full backup and use a staging copy
Back up your code, database and media files, and store a copy off the server. Then apply the patch to a staging environment that matches production first. Magento stores often have many third-party extensions and customisations, and a patch that works on a clean install can still conflict with them.
Step 3: Apply the correct October patch
Download the isolated security patch for your exact version from Adobe’s official security documentation. Do not use patch files from forums or third-party sites. How you apply it depends on how your store is set up:
- Adobe Commerce on Cloud: the security patches can be applied through Magento Cloud Patches.
- On-premises and Magento Open Source: apply the isolated patch file for your version. Adobe also provides a Patching Automation service, part of its Site Wide Analysis Tool, designed to help merchants apply monthly Adobe Commerce security patches.
- Adobe Commerce B2B: check the B2B version and apply any B2B patches that match it.
A cloud patch update may already include a fix. Adobe warns that applying an isolated patch on top of one already included in a cloud patch update can cause installation errors, so read the notes for your environment before you start.
Step 4: Apply the CVE-2026-75650 hotfix
This is the step most likely to be missed. The hotfix comes from the September bulletin (APSB26-146), and Adobe’s October guidance says to apply it in addition to the October security fixes. Check the Commerce Version Tool afterwards to confirm it is installed.
Step 5: Check whether you need the revised 2.4.8-p5 patch
After release, Adobe found that the Community Edition portion of the original 2.4.8-p5 isolated patch was missing an intended defence-in-depth hardening change. A revised patch was published. You may be affected if:
- You run Adobe Commerce or Magento Open Source 2.4.8-p5
- You downloaded the October isolated patch soon after it was first published
- You applied the file named 248p5-2026-10-001-CE.patch
- The Commerce Version Tool now reports your isolated patches as UNKNOWN or reports the revised patch as missing
If that applies to you, download the current October patch again from Adobe’s official documentation and replace the original. Adobe’s notes say that an UNKNOWN result does not by itself mean your store is vulnerable, because the original patch still contained the main fix, but you should apply the revised version to be fully covered. If the tool still reports UNKNOWN after the revised patch and all prerequisite patches are applied, contact Adobe Commerce Support with the full tool output.
Step 6: Rotate encryption keys and credentials
Adobe strongly recommends rotating your encryption keys and associated credentials as part of remediation. This matters because if a vulnerability was exploited before you patched, an attacker may already have copied secrets, and patching alone does not make those secrets safe again. Work with your developer to plan this carefully, because it touches several systems. Typically it includes:
- The Magento encryption key, using Adobe’s documented process
- Administrator passwords, particularly for accounts with high privileges
- API and integration tokens, and OAuth credentials
- Payment gateway and shipping provider keys
- Database, Redis, search engine and message queue passwords
- Third-party API keys stored in configuration
- SSH and deployment keys, if there is any chance they were exposed
Test the process on staging first, and schedule it for a quiet period, because changing keys can affect integrations, saved configuration values and active sessions.
Step 7: Look for signs of compromise
If your store was unpatched for any length of time, check whether it has already been attacked. Warning signs include:
- Administrator accounts you do not recognise
- Unexpected files in your pub/ directory, or recently modified core files
- Unfamiliar cron jobs or scheduled tasks
- Changes to CMS blocks, design configuration or checkout templates that add JavaScript you did not write
- Customers reporting suspicious card charges after buying from you
- Unusual traffic to admin URLs or to unfamiliar file paths
- Unexplained server load or outbound connections
Payment skimming code on checkout pages is a particular risk for Magento stores. If you find anything suspicious, treat it as an incident: preserve logs, isolate the store if needed, bring in a specialist, and consider your legal and card scheme reporting obligations.
Step 8: Check PHP and server updates
Security does not stop at Magento. Reports published on 21 October 2026 describe two critical remote code execution vulnerabilities in PHP, nicknamed PHP2Shell, with fixes released that day. Please verify the details and affected versions on the official PHP site and with your hosting provider, because this was reported by a single source I could find. Whatever the outcome, make sure your PHP version is one that Magento supports and that still receives security fixes, and test any PHP update on staging before applying it to production. Our Magento 2.4.9 upgrade guide covers supported PHP versions.
Step 9: Test thoroughly
A patch can break things quietly. After applying it on staging, test:
- Browsing, search and layered navigation
- Add to cart, checkout and every payment method (including buy now, pay later options)
- Order emails and admin order management
- Shipping rate calculations and tax
- Customer login, registration and password reset
- Admin functions, including product and order editing
- Third-party integrations such as ERP, inventory, accounting and email marketing
- Indexers and cron jobs
- Mobile layout and page speed
Step 10: Deploy, verify and monitor
Deploy during a quiet period with a fresh backup and a rollback plan. Run the Commerce Version Tool again on production to confirm the October patch and the CVE-2026-75650 hotfix show as applied. Then monitor error logs, admin activity, order volume and server performance closely for the next few days.
If you cannot patch immediately
Sometimes a patch has to wait for testing or for a quiet window. In the meantime, reduce your exposure:
- Put the store behind a web application firewall (WAF) such as Cloudflare, Fastly or Sucuri, with rules for known Magento attack patterns.
- Restrict access to your admin panel by IP address or VPN, and use a non-default admin URL.
- Make sure two-factor authentication is enabled for all admin users.
- Disable and remove extensions you do not use.
- Increase logging and alerting, and review logs daily.
- Set a firm date for applying the patch, and keep it short.
These steps lower the risk but do not replace patching.
Magento hardening checklist for peak season
- October security patch (APSB26-153) applied and verified
- CVE-2026-75650 hotfix applied and verified
- Revised 2.4.8-p5 patch applied, if relevant
- Encryption key and credentials rotated
- Admin users reviewed, unused accounts removed, two-factor authentication on
- Admin access restricted by IP or VPN
- WAF in place with bot and attack protection
- Extensions updated, unused ones removed
- File integrity monitoring and malware scanning active
- Checkout pages monitored for unexpected scripts, with a Content Security Policy configured
- PHP and server software on supported, patched versions
- Off-site backups tested, with a documented restore process
- Staging environment matching production
- Uptime and error monitoring with alerts
- Change freeze one week before Black Friday
- Someone on call during the sale
If you are also preparing performance and checkout for the sales period, our Magento support guide explains what ongoing support should include, and our Hyvä theme guide covers one way to improve speed.
Australian compliance and business considerations
Security patching is also a business and compliance issue for Australian merchants:
- Privacy Act 1988. Organisations covered by the Act must take reasonable steps to protect personal information. Delaying critical patches on a store that holds customer data makes that harder to demonstrate, and a data breach may trigger notification obligations under the Notifiable Data Breaches scheme.
- PCI DSS. If you take card payments, PCI DSS 4.0 expects critical security patches to be installed within a set timeframe, generally within a month of release. Check the details with your payment provider or assessor.
- Cyber insurance. Insurers increasingly ask about patching practices, and unpatched systems can complicate a claim or renewal.
- Consumer trust. A breach during a major sale can harm your brand far more than a short maintenance window.
This is general information, not legal advice. Check your specific obligations with your legal or compliance advisers.
Common mistakes to avoid
- Applying the October patch but not the September hotfix. Adobe says you need both.
- Patching without verifying. Always run the Commerce Version Tool afterwards.
- Skipping key rotation. Patching closes the door but does not change the locks.
- Applying patches directly on production. Test on staging first.
- Ignoring the revised 2.4.8-p5 patch. If the tool reports UNKNOWN, investigate it.
- Forgetting extensions. Third-party modules have their own vulnerabilities and update schedules.
- Leaving it until the sale. Patch early, then freeze changes a week before Black Friday.
- Assuming your host handles it. Many hosts manage servers, not Magento application patches, so ask who is responsible.
Expect more patches: build a routine
Adobe releases security updates on a regular monthly schedule, so another bulletin is likely to land in November, around two weeks before Black Friday. Check Adobe’s official release schedule for the exact date. Rather than treating each patch as an emergency, set up a routine: a staging environment, a standard test checklist, an agreed patching window each month, and someone responsible for monitoring Adobe’s bulletins. A proper Magento maintenance plan does exactly this and keeps your store current without last-minute scrambles.
Should you patch in-house or get a specialist?
If you have an experienced Magento developer, a staging environment and good test coverage, you can follow the steps above yourself. Bring in a specialist when you are unsure which patches are installed, you run many extensions or heavy customisations, you suspect your store may have been compromised, you need to rotate keys and credentials safely, or you simply do not have time before the sales period. A good partner will audit your patch status, apply and verify the updates, check for compromise and set up ongoing monitoring.
You can learn more about our Magento maintenance, customer service and support, store upgrade and Magento developer services, and see our Magento development guide for Australian brands.
Frequently asked questions
What is APSB26-153?
It is Adobe’s security bulletin released on 13 October 2026 for Adobe Commerce and Magento Open Source, including Adobe Commerce B2B. It addresses 11 vulnerabilities across critical, high and medium severity levels.
Do I need to apply the CVE-2026-75650 hotfix as well?
Yes. Adobe’s October guidance says to apply the CVE-2026-75650 hotfix in addition to the October security fixes. That hotfix comes from the earlier September bulletin, APSB26-146.
Which Magento versions need the October patch?
Adobe lists updated versions for the 2.4.4 through 2.4.9 release lines. If your store is on any of these and is at the September 2026 patch level or earlier, you should apply the October update. Confirm the exact patch for your version in Adobe’s official documentation.
Why does Adobe recommend rotating encryption keys?
If an attacker exploited a vulnerability before you patched, they may have obtained secrets such as encryption keys and credentials. Patching stops new attacks but does not invalidate secrets that were already taken, so rotating them reduces the risk of continued access.
What does it mean if the Commerce Version Tool reports UNKNOWN?
For 2.4.8-p5 stores that applied the original October Community Edition patch, it usually means the patch was revised and the tool no longer recognises the original. Download and apply the revised patch from Adobe’s documentation. If it still reports UNKNOWN once all prerequisite patches are applied, contact Adobe Commerce Support.
Can I just upgrade to Magento 2.4.9 instead of patching?
Upgrading to the latest release is a good long-term strategy, but it is a bigger project that needs extension compatibility checks and testing. If you cannot finish an upgrade before the sales period, apply the available security patches to your current version now and schedule the upgrade afterwards. See our 2.4.9 upgrade guide.
How long does it take to apply a Magento security patch?
For a well-maintained store with a staging environment, applying and testing a patch can take a few hours to a couple of days. Stores with many extensions, custom code or no staging environment take longer. Key rotation and compromise checks add extra time.
Will patching cause downtime?
It can usually be done with little or no downtime if you use staging and a planned deployment, although some steps, such as running upgrade and compile commands, may require a brief maintenance window. Plan for a quiet period.
How often does Adobe release Magento security patches?
Adobe publishes regular security updates on a monthly schedule and sometimes issues out-of-cycle bulletins for urgent problems. Check the official Adobe Commerce release schedule on Experience League for the next date.
Need help securing your store before Black Friday?
Magento Solutions helps Australian online stores audit, patch and protect their Magento and Adobe Commerce sites. We can check your patch status, apply and verify the October update and CVE-2026-75650 hotfix, rotate your keys safely, look for signs of compromise, and monitor your store through the sales period.
Contact us to book a Magento security and patch audit before Black Friday.