Magento 2.4.9 upgrade guide: PHP 8.5, Symfony 7.4 and what breaks

Magento Open Source and Adobe Commerce 2.4.9 is the newest release line, and it carries the longest runway: Adobe lists regular support through 31 May 2029. For merchants on 2.4.6 or 2.4.7, it is the obvious target.

It is also a heavier upgrade than a typical patch. Several long-standing dependencies were replaced, the minimum PHP version moved up, and some infrastructure components changed. This guide covers what changed, what tends to break, and a step-by-step upgrade process you can adapt to your store.

What changed in 2.4.9

PHP 8.5, with PHP 8.2 and 8.3 dropped

According to Adobe’s 2.4.9 release notes, PHP 8.5 is fully supported. PHP 8.4 is allowed for upgrade purposes only and is not recommended for production. PHP 8.2 and 8.3 are no longer supported. If your servers run 8.2 or 8.3 today, the PHP upgrade is part of this project, not a separate one.

Symfony 7.4 LTS

All Symfony dependencies move to Symfony 7.4 LTS. Symfony 7 added stricter type declarations and changed method signatures. Any custom class that extends a Symfony component needs review. The most common case is CLI commands: custom bin/magento commands extend Symfony\Component\Console\Command\Command, and their configure() and execute() signatures must match the new parent.

// Symfony 7 expects an int return type on execute()
protected function execute(InputInterface $input, OutputInterface $output): int
{
    // ...
    return Command::SUCCESS;
}

Laminas MVC replaced by a native MVC implementation

Adobe replaced the legacy Laminas MVC layer with Magento’s own MVC implementation. Most store code never touches Laminas MVC directly, but some older extensions and custom modules import Laminas classes for request handling, routing or HTTP responses. Search your codebase for those imports before you start.

Zend_Cache replaced by Symfony Cache

The deprecated Zend_Cache component gives way to Symfony Cache. Adobe states that existing cache backends remain supported and no integration changes are required. Custom cache backends or code that calls Zend_Cache classes directly still need testing.

Other changes that affect upgrades

• WYSIWYG editor: TinyMCE is replaced by HugeRTE because TinyMCE 5 and 6 reached end of support. Extensions that customize the editor need checking.
• OAuth: the third-party OAuth library is replaced with native PHP functions.
• JWT framework: updated to its latest major version.
• Two-factor authentication: admins now need to set up one provider rather than every enabled provider.
• JavaScript libraries: jQuery UI, jQuery Validate, Less.js, Underscore.js, Chart.js and others were updated, which can affect custom themes.

CAPTCHA enforced on API account creation

When CAPTCHA or reCAPTCHA is enabled for the storefront Create Account form, 2.4.9 now enforces the same validation for customer account creation through REST and GraphQL. reCAPTCHA validation is also added to several GraphQL mutations, including updateCustomer.

This closes a common bot sign-up route. It also breaks headless frontends, mobile apps and integrations that create customer accounts through the API without sending a CAPTCHA token. Test those flows explicitly.

System requirements

The table below reflects Adobe’s 2.4.9 release notes and system requirements page at the time of writing. Always confirm against the current system requirements page before ordering infrastructure changes, because Adobe updates it with each patch.

Two points stand out. Adobe notes that MySQL 8.0 reached end of support on 30 April 2026. And the 2.4.9 on-premises table lists Valkey rather than Redis for caching and sessions, so plan that switch if you still run Redis.

Step-by-step upgrade process

1. Audit code and extensions

Start with an inventory, because this is where most of the effort goes.

# list installed third-party modules
bin/magento module:status --enabled | grep -v "^Magento_"

# find code that touches replaced components
grep -rn "Laminas\\\\Mvc\|Zend_Cache\|Symfony\\\\Component\\\\Console" app/code vendor/<your-vendors>

For each extension, check whether the vendor has released a version marked compatible with 2.4.9 and PHP 8.5. Remove modules you no longer use. Every module removed is one less to test.

2. Prepare a staging environment that mirrors the new stack

Build staging on PHP 8.5, OpenSearch 3, MySQL 8.4 or MariaDB 11.8/12.x and Valkey. Load a recent copy of production data. Upgrading code and infrastructure together on staging shows real problems early.

3. Back up and enable maintenance mode

bin/magento maintenance:enable
mysqldump --single-transaction --routines --triggers dbname > pre-249.sql
tar -czf pre-249-code.tgz app composer.json composer.lock

4. Update Composer requirements

For Magento Open Source:

composer require-commerce magento/product-community-edition 2.4.9 --no-update
composer update

For Adobe Commerce, use magento/product-enterprise-edition. The require-commerce command comes from Adobe’s composer-root-update plugin and adjusts root dependencies for you. Expect conflicts on the first run. Resolve them by upgrading extension versions, not by forcing older constraints.

5. Run the upgrade and rebuild

bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f
bin/magento indexer:reindex
bin/magento cache:flush
bin/magento maintenance:disable

Fix compile errors before anything else. Signature mismatches against Symfony 7.4 and missing Laminas classes usually surface here.

Common errors after the Composer step

• Declaration must be compatible with Symfony\Component\…: a custom class overrides a Symfony method with an old signature. Add the parameter and return types the parent now declares.
• Class “Laminas\Mvc\…” not found: a module still depends on Laminas MVC. Update the extension or refactor the code to use Magento’s own request and response classes.
• Composer conflicts on PHP version: an extension’s composer.json caps PHP below 8.5. Check for a newer release from the vendor before you consider a fork.
• Admin editor fields render blank: a module customizes TinyMCE configuration that no longer applies under HugeRTE.

Log each fix in your repository with a clear commit message. On the production run, you want the same sequence to apply cleanly with no manual edits.

6. Test what is most likely to break

• Checkout end to end with every payment method and shipping carrier.
• Customer registration from the storefront, the mobile app and any headless frontend.
• Custom CLI commands and cron jobs.
• Admin CMS editing, now using HugeRTE.
• ERP, PIM and marketplace integrations, including OAuth-based ones.
• Search results and layered navigation on OpenSearch 3.

7. Apply the latest security patches

A fresh 2.4.9 install is not automatically current. In September 2026 Adobe released the APSB26-138 update and, separately, the APSB26-146 hotfix for the actively exploited CVE-2026-75650 (StyleSmuggler). The hotfix is not included in the September isolated patch, so apply both before going live.

8. Plan the production cutover

Rehearse the deployment on staging with timing, decide on a rollback point, and schedule the release in a low-traffic window. Watch error logs, conversion rate and payment failures closely for the first days.

Frequently asked questions

How long is Magento 2.4.9 supported?

Adobe’s released versions page lists regular support for 2.4.9 until 31 May 2029. It was released on 12 May 2026.

Can I run 2.4.9 on PHP 8.3?

No. Adobe’s release notes state PHP 8.2 and 8.3 are no longer supported. PHP 8.5 is fully supported, and 8.4 is allowed only for upgrade purposes.

Will my extensions work on 2.4.9?

Only testing confirms it. Extensions most at risk extend Symfony classes, use Laminas MVC directly, customize the WYSIWYG editor or create customers through the API.

Should I go to 2.4.8 instead because it is less disruptive?

2.4.8 is supported until 31 May 2028, one year less than 2.4.9. If you are already doing a major upgrade, moving to 2.4.9 usually avoids a second framework migration soon after.

Sources

• Adobe Commerce 2.4.9 release notes
• Magento Open Source 2.4.9 release notes
• Adobe Commerce released versions and support dates
• Adobe Commerce system requirements
• Security update available for Adobe Commerce, APSB26-138
• Critical security update for Adobe Commerce, APSB26-146