:quality(75))
October 2021 was a patch month for Adobe Commerce and Magento Open Source teams alike. Adobe shipped 2.4.3-p1, with a parallel 2.3.7-p2, hardening recent changes and addressing the issues called out in APSB21-86 — including an Important CSRF vulnerability (CVE-2021-39864). The dual track said two things at once: Adobe was still supporting 2.3.x, and a lot of stores were still sitting on it.
The timing was the real story. PHP 7.3 was scheduled to reach end of life in December 2021, so the move to PHP 7.4 — and the planning for PHP 8.x — had stopped being optional. Security is not a project with an end date. Waiting for the perfect upgrade window usually adds risk rather than removing it.
Make patching routine
The useful shift is treating security patches and minor upgrades as ordinary change rather than an event. That needs very little: smoke tests for checkout and account operations, a rolling calendar of maintenance windows, and enough communication that the business knows what is landing and when.
Smaller releases are easier when the codebase is tidy. Removing unused modules, separating concerns in customisations and checking that extension vendors are still supporting their work all reduce the friction of staying current. If you maintain extensions in house, basic CI with static analysis and unit tests turns patch uptake from a heroic effort into a routine one.
What to do next
Apply the latest security patch for your version line — 2.4.3-p1 or 2.3.7-p2 — and verify checkout, my account and admin flows.
If you are on PHP 7.3, schedule PHP 7.4 as a short stop on the way to PHP 8.1+.
Inventory your extensions, confirm vendor support commitments and delete the modules nobody uses.
Set a quarterly patch cadence with a fixed maintenance window and a short automated test pack.
What this means for you
October 2021 shipped no features worth talking about. The teams that used it to build a steady upgrade rhythm are the ones that found 2022's bigger moves — PHP 8.1, OpenSearch — straightforward rather than alarming.