Magento 2.4.6-p6 and 2.4.7-p1: the June 2024 security updates
Magento 2.4.6-p6 and 2.4.7-p1 fix CosmicSting among other issues. What is in these patch releases, which one applies to you and how to apply it safely.
On 11 June 2024, Adobe released security updates for all supported versions of Magento 2 and Adobe Commerce. For most shops, 2.4.6-p6 and 2.4.7-p1 are the relevant ones.
What the updates contain
Both are patch releases: they fix security vulnerabilities and individual bugs but add no new features. The most important fix is for CosmicSting (CVE-2024-34102), which can be exploited without logging in. The full list is in bulletin APSB24-40.
- 2.4.6-p6 for shops on 2.4.6, still with PHP 8.1 or 8.2
- 2.4.7-p1 for shops on 2.4.7, with PHP 8.2 or 8.3
- For older release lines there are 2.4.5-p8 and 2.4.4-p9
Which update for whom?
A patch release within your own release line is usually quick to apply, because the PHP version and dependencies stay the same. Moving from 2.4.6 to 2.4.7 is a real version upgrade with a new PHP version and should be planned. My advice: apply the security patch in your current line first, then do the bigger upgrade without time pressure.
How I apply patches
- Backup of code and database
- Update on a staging environment, check extensions and custom modules
- Test the main flows: search, cart, checkout, admin, cron jobs
- Go-live with a short maintenance window, then check the logs
If you need help, write to me.
Source: Adobe APSB24-40.