Magento 2.4.9 Has Landed: What the Biggest Magento Release in Years Means for Your Store

Magento 2.4.9 brings the platform's foundations firmly into 2026, retiring older dependencies in favour of faster, better-supported technologies. The headline change is full support for PHP 8.5, with 8.2 dropped from the compatibility matrix. The wider stack has moved on too — MySQL 8.4, MariaDB 11.4, OpenSearch 3, Valkey 8 for caching, and Apache ActiveMQ Artemis as an alternative to RabbitMQ.

The real shift, however, is under the hood. Three significant framework components have been replaced: Laminas MVC swapped for a native PHP MVC implementation, Zend_Cache replaced with Symfony Cache (now targeting Symfony 7.4 LTS), and TinyMCE replaced by HugeRTE, an MIT-licensed fork. The third-party OAuth library has also been dropped in favour of native PHP OAuth functions.

• Faster execution thanks to PHP 8.5's performance improvements over 8.2 and 8.3.
• Long-term framework stability via Symfony 7.4 LTS, which extends Magento's supported runway for years.
• Fewer third-party dependencies, which means a smaller attack surface and less risk of upstream packages being abandoned.
• Modern caching through Valkey 8 — the actively maintained, open-source successor to Redis — for better cache performance and licensing clarity.
• More messaging flexibility with ActiveMQ Artemis added as a RabbitMQ alternative, useful for stores with heavy async workloads.

Released alongside 2.4.9 GA, the March 2026 security bulletin APSB26-05 patched 17 CVEs across all supported Magento versions, including 7 rated Critical — covering arbitrary code execution and privilege escalation vulnerabilities. The 2.4.9 release rolls these fixes in by default and adds further hardening on top.

• CAPTCHA enforcement extended to API requests and customer registration, closing off bot vectors that historically slipped past frontend protections.
• Streamlined admin 2FA experience, making strong authentication less of a friction point for merchant teams.
• Updated Content Security Policy to support the latest Cardinal (3-D Secure) integration requirements out of the box.
• 17 CVEs patched — 7 Critical — including arbitrary code execution and privilege escalation vulnerabilities.

Easily the biggest functional story in 2.4.9 is the wave of Braintree enhancements. If you process payments through Braintree — and many UK and EU merchants do — this release alone is a strong argument for upgrading.

• Google Pay vaulting: customers can now save Google Pay cards in their account area, view them under stored payment methods, and reuse or delete them — bringing Google Pay in line with Cards and PayPal.
• Real Time Account Updater (RTAU) for vaulted Visa, Mastercard and Discover cards in Adobe Commerce, which keeps stored card details automatically refreshed and reduces failed renewal payments.
• ELO card support added for the Brazilian market.
• Pay Upon Invoice ("Rechnungskauf mit Ratepay") added as a BNPL local payment method for German shoppers, powered by PayPal and Ratepay, with 30-day invoice terms and no PayPal account required.
• BLIK added as a local payment method for Polish shoppers, plugged into the existing Braintree Local Payment Methods flow.
• Apple Pay on Chrome and Firefox: Apple Pay Express is no longer Safari-only — buyers on other browsers can scan a code with their iPhone to complete payment.
• Promo codes inside Apple Pay and Google Pay sheets: shoppers can apply, view and remove cart promotions directly from the express payment sheet, so express checkout customers aren't penalised for skipping the standard flow.
• Server-side PayPal Express shipping callback, replacing the client-side version for better reliability.
• PayPal Contact Module for U.S. merchants, letting buyers update the email and phone number shared with the merchant from inside the PayPal modal during express flows.

Adobe's release notes confirm 581 issues fixed in the core code for 2.4.9, with the total across all alpha and beta releases topping 891 fixes. The bulk are quality and stability improvements rather than headline features, but several stand out.

• REST API scope fixes — updating products via REST in a store scope no longer accidentally inherits image and video changes from global scope, and scope inheritance can now be restored via REST by setting the field to NULL.
• EAV cache invalidation fixes that resolved missing product attribute values after new attributes were added to an attribute set.
• WebAPI account activation fix — customers can now activate accounts via WebAPI without hitting the previous authorisation paradox that required a token before confirmation.
• Hundreds of smaller fixes across checkout, inventory, catalog performance, and admin tooling.
• Cleaner codebase for dev teams — native MVC, current Symfony, fewer abandoned libraries — which translates to easier hiring, faster onboarding, and fewer dead-end debugging sessions in legacy code paths.

The short answer is: plan it now, execute deliberately. Magento 2.4.9 is a strategic upgrade rather than a same-day production change. The framework replacements affect any extension that hooked into Laminas MVC or TinyMCE, which means extension vendors and custom modules need to be tested before you go live. Hosting environments also need to meet the new minimums — PHP 8.3+, MySQL 8.4 or MariaDB 11.4, OpenSearch 3, and so on.

The good news is that the upgrade case is genuinely compelling this time. The combination of PHP 8.5 performance, Valkey caching, the Braintree checkout improvements and the security hardening means 2.4.9 should pay for itself in conversion, performance and reduced risk — not just in "we're on the latest version" peace of mind.