Unexpected SHA-256–named file appears in the Adobe Commerce project root
This article describes a known issue where a file with a long hexadecimal name is created in the Adobe Commerce project root after applying the October 2026 Isolated security patch.
Description description
Affected products and versions
This issue occurs only when both of the following apply:
-
You have applied the October 2026 Isolated security patch (APSB26-153), and
-
You are running Adobe Commerce on Cloud infrastructure, Adobe Commerce on-premises, or Magento Open Source on one of the following versions:
- 2.4.10-alpha1
- 2.4.9
- 2.4.8-p5
- 2.4.7-p10
- 2.4.6-p15
- 2.4.5-p17
- 2.4.4-p18
Both Developer and Production modes are affected.
Installations that haven’t applied the October 2026 Isolated patch aren’t affected.
Issue
After applying the October 2026 Isolated security patch, an empty file named with a 64-character hexadecimal string is created in the project root:
976bc24c08055e67a58cf491401c8b2f3d48ff55b8092f1ede196bac4756a228
The name is identical across all affected installations.
To reproduce, run the following from the project root:
rm -f 976bc24c08055e67a58cf491401c8b2f3d48ff55b8092f1ede196bac4756a228
touch var/.regenerate
bin/magento
The file reappears. Running bin/magento setup:upgrade isn’t required — any bin/magento invocation recreates it, while the var/.regenerate trigger is present.
Cause
A change to file-based locking in Magento\Framework\Lock\Backend\FileLock, included in the October 2026 Isolated security patch, altered how lock filenames are derived. As a result, the generated-files cleanup lock is written to the installation root under a hashed name instead of its previous location at var/.regenerate.lock.
Resolution resolution
Adobe has identified this as an unintended side effect and will restore the previous lock file location in an upcoming release.
No customer action is required to remain protected — the security fixes delivered by the October 2026 Isolated patch are unaffected by this issue, and you shouldn’t reverse the patch.
Until the corrected release is available, you can safely ignore the file. It’s an empty lock file containing no configuration, credential, or customer data, and its presence doesn’t indicate a misconfiguration nor a compromised installation.
To keep it out of source control, add it to your .gitignore:
/976bc24c08055e67a58cf491401c8b2f3d48ff55b8092f1ede196bac4756a228
bin/magento commands, cron, or deployment processes are running. Locking is advisory and tied to the file itself, so removing it doesn’t release a lock that is currently held — a subsequent process will create a new file and acquire its own lock, allowing two cleanup processes to run at the same time.Additional information
- On Adobe Commerce on Cloud infrastructure, the file is written to the project root on each deploy. This is expected and doesn’t require a support ticket.
- For the October 2026 security update and patch download links, see Security update available for Adobe Commerce - APSB26-153.