Releases

Security Port of Adobe's October isolated patch (APSB26-153). This release includes fixes for security issues rated CVSS 10.0. All 3.x users should upgrade.

Ports Adobe's hotfix for StyleSmuggler (CVE-2026-75650, CVSS 10.0), an unauthenticated RCE exploited in the wild since 4 September. Upgrade immediately — and read the remediation steps, because patching alone is not enough.

Ports Adobe's August security patch (APSB26-92), covering access-control fixes in the admin media gallery, product review saving and customer account edit. All 3.x users should upgrade promptly.

Fixes a critical vulnerability in the bundled PageBuilder template import module, plus PHP 8.5 compatibility work and Redis cache fixes. All 3.x users should upgrade.

With Magento security patch 249-2026-07-001, along with other fixes and improvements. All 3.x users should upgrade.

Mage-OS 3.1.0 brings Mage-OS package name support to the Composer root-update plugin, sixteen core stability fixes, and bundled add-on updates. Built on the same Magento Open Source 2.4.9 base as 3.0.0 — a low-risk, drop-in upgrade.