Is Magento dead in 2028? What end of life really means

"Is Magento dead?" is one of the questions we hear most often from merchants in 2026, and it usually comes with a date attached. 2028. 2029. Sometimes even 2027.

The short answer: no. Magento isn't dying. Specific versions are.

The confusion is understandable. Adobe publishes end-of-support dates per release line, in a policy written for Adobe Commerce customers, with three different kinds of support and separate enforcement dates for Cloud. Skim it once and "2.4.8 support ends in May 2028" quietly turns into "Magento ends in 2028". It doesn't.

This article explains how the lifecycle really works, what extended support gives you, why staying current is now a security requirement rather than a nice-to-have, and why, even in the worst case, the platform has a community-backed future that doesn't depend on any single vendor.

Release lines expire. Platforms don't.

How Adobe's lifecycle actually works

Adobe doesn't set an end date for Magento. It sets an end date for each release line (2.4.7, 2.4.8, 2.4.9 and so on) and keeps shipping new ones.

Every release line gets three years of standard support from its general availability (GA) date. Since 2.4.7, those windows all close on 31 May, roughly three years after release. Standard support covers quality fixes, security patches and full support from Adobe.

Around that sits a predictable cadence: one feature release a year (in May), monthly isolated security patches when needed, and an alpha and beta cycle for the next line. 2.4.9 went GA on 12 May 2026, and 2.4.10-alpha1 followed on 13 October 2026. There is no Magento 3 on the roadmap. The platform evolves inside 2.4.x.

Source: Adobe Commerce lifecycle policy, as of November 2026.

So where do 2028 and 2029 come from? They're simply the end of standard support for 2.4.8 and 2.4.9. By then, 2.4.10 and 2.4.11 will be out, each with a fresh three-year window of its own.

It's a rolling window, not a countdown. Upgrade roughly every two to three years and you never leave support.

Extended support: the safety net (and who gets it)

On top of standard support, Adobe adds a buffer in two forms:

Extended support. One extra year at no additional cost, with quality and security patches for the core application. Currently offered for 2.4.6 and 2.4.7.

Security-only transitional period. A one-time window for 2.4.4, 2.4.5 and 2.4.6, with limited isolated security fixes and no quality fixes. Adobe says plainly it won't be extended and should be treated as migration time.

There's a catch most articles skip: the policy is written for Adobe Commerce. Adobe has previously stated that extended support is not available for the Magento Open Source code base, and the October 2026 security bulletin listed no fixed Open Source release for 2.4.6.

What that means in practice:

On Adobe Commerce? You have more runway than the headline dates suggest. Use it to plan, not to postpone.

On Magento Open Source? Treat the end of standard support as your real deadline.

On Adobe Commerce Cloud? There's also an enforcement date: 1 June 2028 for 2.4.6 and 2.4.7. Past it, Adobe may suspend traffic to non-compliant environments.

Extended support buys time. It doesn't buy a strategy.

Why upgrading isn't optional anymore

Ecommerce doesn't stand still, and neither do attackers. Autumn 2026 made that very clear.

September: StyleSmuggler (CVE-2026-75650). An unauthenticated remote code execution flaw in Magento's template engine, rated CVSS 10.0 and exploited in the wild from 4 September. Every version from 2.4.4 to 2.4.9 was affected. Adobe shipped an emergency hotfix on 7 September (APSB26-146), and CISA added the flaw to its Known Exploited Vulnerabilities catalogue.

October: BlockStrap (CVE-2026-103849). Six weeks later came a second CVSS 10.0 template-engine flaw, effectively a bypass of the September fix. Adobe's 13 October bulletin (APSB26-153) closed it along with ten other vulnerabilities, five of them critical. The September hotfix is still required on top.

The lesson isn't "Magento is insecure". Every widely used platform gets critical CVEs. The lesson is that fixes only reach supported release lines. If your store ran Open Source 2.4.6 in October, there was no official fix to install.

PHP is part of the same equation

Magento support and PHP support are tied together. Each Magento line requires specific PHP versions, and PHP has a hard lifecycle of its own:

Adobe itself warns that running an end-of-life PHP version puts PCI compliance at risk. It also doesn't patch third-party dependencies (MariaDB, OpenSearch, Valkey or Redis, RabbitMQ) once they reach end of life. Staying current is a stack decision, not just a Composer bump.

Upgrade little and often. A yearly move to the latest line is a few weeks of work. Skip three lines and it becomes a project.

Plan B already exists: Mage-OS

Take the most pessimistic scenario: Adobe stops shipping Magento Open Source altogether. Even that isn't the end of the platform.

Mage-OS is an independent, non-profit distribution of Magento Open Source, run by the community and not affiliated with Adobe. It's a drop-in compatible fork: existing modules, extensions and themes keep working.

And it's no dormant mirror. In 2026 alone:

Mage-OS 3.0 shipped on 18 May 2026 on top of Magento 2.4.9, adding built-in RMA, an improved installer and semantic versioning.

A dedicated release manager joined to speed up security turnaround.

Mage-OS 3.5.0 shipped on 8 September 2026, one day after Adobe's StyleSmuggler hotfix. It ported the fix into source, delivered it as a normal Composer upgrade and added extra hardening beyond Adobe's own patch.

That last point matters most. When a CVSS 10 hit, the community fork had a production-ready release out within a day. That's what "maintained" looks like.

Mage-OS doesn't replace Magento. It insures it.

OpenMage: proof that forks outlive vendors

Want to know what happens to Magento 2 after an official end of life? Look at Magento 1.

Adobe ended Magento 1 in June 2020. Six years later, OpenMage LTS, the community fork of Magento 1, is still maintained. Version 20.18.0 shipped in May 2026, the codebase runs on PHP up to 8.4, and legacy dependencies such as Zend Framework 1 have been replaced. The project also commits to a published policy: each major line gets patches for at least two years.

That's a platform with a fraction of Magento 2's ecosystem, still receiving security fixes six years after its vendor walked away.

Magento 2 starts from a much stronger position: a far larger install base, a bigger agency and extension ecosystem, and, unlike Magento 1 back then, an organised fork already running in parallel before any end of life. If OpenMage could keep Magento 1 alive, Magento 2 has every reason to outlast any date in Adobe's table.

So, is Magento dead in 2028 or 2029?

No. Here's the honest picture:

2028 is when standard support for 2.4.8 ends. Not Magento.

2029 is when standard support for 2.4.9 ends. Not Magento.

New lines keep coming. 2.4.10 is already in alpha, on Adobe's yearly cadence.

Adobe Commerce customers get extra runway through extended support.

Open Source merchants have Mage-OS as a maintained, compatible path that doesn't depend on Adobe.

History says forks survive. OpenMage still ships for Magento 1, six years on.

What is dying is the habit of installing Magento and leaving it alone for five years. That model was never safe. In 2026 it stopped being viable.

Where to start

Start with an honest audit, not a replatforming RFP.

Check your line and edition. Look for magento/product-community-edition or magento/product-enterprise-edition in composer.lock. The edition decides which dates apply to you.

Map the whole stack. PHP, database, OpenSearch, Valkey or Redis, RabbitMQ, Varnish. The earliest end-of-life date in that list is your real deadline.

Confirm the autumn 2026 fixes are in. You need both the September hotfix and the October bulletin. One does not cover the other.

Put upgrades on the roadmap as a recurring cost, ideally once a year after each May release.

On Open Source? Evaluate Mage-OS as a parallel option, not a last resort.

Not sure where your store stands? We can run a short upgrade assessment covering version, stack, extensions and the risks that matter most, then plan the next step together.

Get in Touch