When did 2.3.x reach end-of-support?

Q: When did 2.3.x reach end-of-support?

The Magento 2.3.x line hit end-of-software-support on 9 September 2022. Adobe stopped shipping security patches for 2.3.x after that date. Any store still on 2.3.x in 2026 is carrying every CVE published in the last three-plus years, including several rated 9+ on the CVSS scale.What this means in practice:PCI-DSS: 2.3.x stores fail PCI compliance audits on the “unsupported platform” control. Some processors (Stripe, Adyen, Braintree) flag the merchant; others quietly add risk premiums.Insurance: Cyber-insurance renewals increasingly exclude breaches on EOL platforms.Extension support: Most extension vendors have dropped 2.3.x from their compatibility matrix. New features ship for 2.4.x only.Hyvä: Hyvä themes don’t support 2.3.x. If you’re planning a Hyvä migration, the upgrade comes first.The recommended path off 2.3.x: 2.3.x → 2.4.4 → 2.4.9 (two-hop). 2.4.4 is the sane intermediate stop because it’s the first version on PHP 8.1+ and composer 2.x, so you get the major framework changes in one digestible hop. Doing 2.3.x → 2.4.9 direct is technically possible but the regression surface is unmanageable.

Question

Accepted Answer

The Magento 2.3.x line hit end-of-software-support on 9 September 2022. Adobe stopped shipping security patches for 2.3.x after that date. Any store still on 2.3.x in 2026 is carrying every CVE published in the last three-plus years, including several rated 9+ on the CVSS scale.

What this means in practice:

PCI-DSS: 2.3.x stores fail PCI compliance audits on the “unsupported platform” control. Some processors (Stripe, Adyen, Braintree) flag the merchant; others quietly add risk premiums.
Insurance: Cyber-insurance renewals increasingly exclude breaches on EOL platforms.
Extension support: Most extension vendors have dropped 2.3.x from their compatibility matrix. New features ship for 2.4.x only.
Hyvä: Hyvä themes don’t support 2.3.x. If you’re planning a Hyvä migration, the upgrade comes first.

The recommended path off 2.3.x: 2.3.x → 2.4.4 → 2.4.9 (two-hop). 2.4.4 is the sane intermediate stop because it’s the first version on PHP 8.1+ and composer 2.x, so you get the major framework changes in one digestible hop. Doing 2.3.x → 2.4.9 direct is technically possible but the regression surface is unmanageable.