Magento and Adobe Commerce stores need October's security patch
What they said
Read the original ↗“Adobe also strongly recommends rotating your encryption keys and associated credentials as part of remediation.”
In plain English
Adobe released a critical security update for Adobe Commerce and Magento Open Source on 13 October 2026. Stores also need a separate hotfix released in September for another serious flaw. Adobe recommends changing your store's encryption keys and passwords as part of the fix.
Why it matters
Magento stores are a common target for hackers, especially in the run-up to Black Friday. An unpatched store risks card skimming, stolen customer data or downtime.
What to do
- 1Confirm both patches are installedYour developer
Ask your developer or agency to check that the October 2026 security update and the September hotfix are both applied. They're separate, so having one doesn't mean you have the other.
- 2Change encryption keys and passwordsYour developer
Adobe recommends rotating your store's encryption keys and changing admin passwords as part of this fix. Do it after patching, and make sure every admin user sets a new password.
- 3Check your version with Adobe's toolYour developer
Adobe's Commerce Version Tool shows exactly which version and patches your store is running, so you're not relying on memory.
- 4Plan patching into your calendarYou
Adobe releases security updates regularly. Agree with your developer how quickly they'll be applied, ideally within days of release, so you're never far behind before peak.
Found by our AI agent and checked by Peter Screeton, Founder of Create8. He confirmed the original source is genuine and that this summary matches what it said when published.