Skip to main content

How to Apply a Magento 2 Patch Without Composer (Step-by-Step)

Keeping your Magento 2 store secure and up to date is not just best practice, it’s essential. Every unpatched vulnerability leaves your store open to potential exploits, risking customer trust and site stability. In this guide, you’ll learn how to apply a Magento 2 patch manually, without using Composer to keep your store safe and running smoothly.

This guide walks you through how to manually apply a Magento 2 patch (commonly provided in .composer.patch format), using the recent Adobe Commerce APSB24-40 security update as an example.

Step-by-Step Guide to Manually Applying a Magento 2 Patch

Step 1: Download the Patch

Visit Adobe’s official Security Bulletins and navigate to the patch relevant to your Magento 2 version. For this guide, we’ll reference:

🔗 Adobe Commerce APSB24-40 Patch

Be sure to choose the patch that matches your exact Magento version, such as 2.4.6-p5 or 2.4.5-p6.

Step 2: Unzip the Patch File

Once downloaded, unzip the .zip archive. Inside, you’ll typically find one or more files ending in .composer.patch.

Example:

VULN-27015-2.4.6x.composer.patch

Step 3: Apply the Patch Manually

  1. SSH into your server and navigate to the Magento root directory
cd /path/to/your/magento2/root

2. Run the patch command: 

patch -p1 < VULN-27015-2.4.6x.composer.patch

Replace the filename above with the actual name of your patch file.

💡 Note: The -p1 option tells the patch command how to interpret file paths inside the patch. If you see “file not found” errors, try adjusting the -p number (e.g., -p0, -p2) depending on your directory structure.

Step 4: Clear Cache and Recompile

After applying the patch, clear Magento’s cache and recompile (if necessary):

php bin/magento cache:clean
php bin/magento cache:flush
php bin/magento setup:di:compile

Step 5: Verify the Patch Was Successful

Don’t stop at applying the patch, validate it.

  • ✅ Check your web server or Magento log files (var/log/, var/report/) for errors.
  • ✅ Test core store functionality: browsing, checkout, customer login, etc.
  • ✅ Run a security scan with Adobe’s Security Scan Tool or an external tool like MageReport.
  • ✅ Look at patch-specific files to confirm they were updated as expected.

Best Practices for Patch Management

Here are some key tips for staying ahead:

  • Test in staging first: Always apply patches in a staging environment before production.
  • Backup everything: Ensure both files and database are backed up.
  • Track patch history: Keep a log of which patches you’ve applied and when.
  • Stay informed: Subscribe to Adobe Commerce Security Updates and Magento DevDocs to stay ahead of new releases.

Additional Resources

Applying Magento 2 patches is vital to safeguarding your store and customer data. Even if you’re not using Composer, you can still manually apply critical updates with a few simple terminal commands. Follow the steps above, test thoroughly, and make patching part of your regular maintenance routine.

Keeping your store secure isn’t just a one-time task, it’s an ongoing commitment.

You might also like