Magento Open Source 2.4.9 shipped on May 12, 2026. If you're planning an upgrade today, start with what's new in Magento Open Source 2.4.9. This article stays as the 2.4.8 snapshot.
Magento 2.4.8 drops PHP 8.1, adds PHP 8.4, deprecates Elasticsearch so OpenSearch is the only search engine Adobe supports, and moves encryption key rotation to the CLI. Here's what changes in your upgrade, and what doesn't.
Magento 2.4.8 at a glance
| Area | What changed in 2.4.8 |
|---|---|
| PHP | 8.3 and 8.4 supported, 8.1 dropped |
| Database | MySQL 8.4 and MariaDB 11.4 support added |
| Search | Elasticsearch deprecated, OpenSearch is the supported engine |
| Indexers | New indexers default to Update by Schedule |
| Encryption key rotation | Admin screen removed, use bin/magento encryption:key:change |
| RequireJS | Upgraded to 2.3.7 |
Patch releases have kept moving since launch. As of 2.4.8-p5, Adobe's system requirements list PHP 8.4/8.3, MariaDB 11.4/11.8, MySQL 8.4, OpenSearch 3 (Elasticsearch 8 is still listed), Valkey 8.1 and Varnish 8.
Which PHP versions does Magento 2.4.8 support?
The update that stands out most in Magento 2.4.8 is PHP 8.3 and PHP 8.4 compatibility. Adobe dropped support for PHP 8.1 entirely, so a store still on 8.1 has to move PHP before (or with) the Magento upgrade.
The framework's composer constraint still allows PHP 8.2, but Adobe's system requirements only list 8.3 and 8.4, so treat 8.2 as a bridge for the upgrade rather than a place to stay.
It also means you get to use PHP 8.3's newer features in your own modules, such as typed class constants and the fresh #[Override] attribute.
Magento 2.4.8 also runs on PHP 8.4, which means you can start using the new PHP 8.4 features, like property hooks and asymmetric visibility, in your own modules today.
MySQL and MariaDB Database Engine Updates
Magento 2.4.8 adds support for MySQL 8.4 and MariaDB 11.4. Both are long-term releases, with MySQL 8.4 supported until April 2032 and MariaDB 11.4 through May 2029.
The database upgrade is also a good time to check your character set. If any tables are still on utf8mb3, moving them to utf8mb4 is what gives you full Unicode support, emoji included, which international stores especially need.
Does Magento 2.4.8 still support Elasticsearch?
Not officially. Adobe deprecated Elasticsearch in 2.4.8 and only supports OpenSearch going forward. The Elasticsearch 7 and 8 options are still in the Admin, but they're labelled Deprecated, with a note that Adobe no longer supports them. That's a deprecation, not a removal, but it's a clear signal: plan your move to OpenSearch now rather than at the next upgrade.
The migration touches more than the search box. It affects how Magento talks to its search layer, which can change relevance scoring, and any custom extension built around Elasticsearch-specific features needs testing against OpenSearch.
GraphQL Enhancements for Headless Commerce
Magento 2.4.8's GraphQL layer got a good amount of attention. The framework now supports custom scalar types in the GraphQL schema, which helps when you build custom frontends and PWAs. You can express values that need validation, such as HTML, emails, URLs or dates, without writing custom parsing logic.
Sorting products by multiple fields through GraphQL now works as expected, too. It's a small change, but it gives you more control over product listings without writing custom backend logic, which matters on stores with large catalogs.
Cache management for GraphQL resolvers improved as well: caches are now invalidated when customer data is updated through imports, so the GraphQL layer doesn't serve stale data after a backend update.
Not sure what's going on in this section? Find out how GraphQL works.
Performance improvements
The most notable performance fix in Magento 2.4.8 is in the queries behind related, up-sell and cross-sell blocks, which could previously flood the database. Stores with big catalogs or complex product configurations benefit the most.
The default indexer mode for new indexers changed from "Update on Save" to "Update by Schedule" (existing indexers aren't affected). It's a subtle, but fairly impactful change, especially for third-party modules that add their own indexers.
Update by Schedule queues indexing work for cron rather than running it right after each save, which keeps performance steadier during large imports or catalog updates.
Security XSS and RCE Fixes
Magento 2.4.8 fixes several potential XSS vulnerabilities, and closes a few other holes that could have led to RCE. As always, these matter for protecting customer data and for PCI DSS compliance.
Encryption key rotation also moved out of the Admin and into the CLI. The System > Manage Encryption Key screen is gone, and you now run bin/magento encryption:key:change instead (Adobe's encryption key docs have the details). That fits deployment pipelines and multi-server setups much better anyway.
The upgrade of RequireJS to version 2.3.7 addresses a vulnerability (CVE-2024-38999), and the Prototype.js fix for CVE-2020-27511 closes a ReDoS issue.
B2B and Commerce Features
B2B is an Adobe Commerce feature, not part of Open Source, but if you work on both: Adobe Commerce B2B also gets shared catalog visibility fixes and negotiable quotes in GraphQL (neither is in Open Source).
The REST API now handles order comment status changes consistently with the current order state, which makes order management integrations more predictable.
Braintree got a few improvements too: shipping options now show directly in the PayPal modal, and package tracking support improved.
Recap
If you're on 2.4.7, the PHP and OpenSearch moves are the work; everything else is a normal patch upgrade.
Review your custom backend code against PHP 8.3/8.4, test against the new database versions, and get off Elasticsearch. Once you're on 2.4.8, the next step is Magento Open Source 2.4.9, which moves the supported PHP version to 8.5.
Have you hit anything in a 2.4.8 upgrade that isn't covered here? I'd love to hear about it.
