[{"data":1,"prerenderedAt":1170},["ShallowReactive",2],{"locale-routes":3,"squeeze-paths":241,"announcements":242,"page-\u002Fen\u002Finsights\u002Fphp-vulnerability-php2shell-shopware":243,"insights-author-\u002Fen\u002Finsights\u002Fphp-vulnerability-php2shell-shopware":975},{"home":4,"shopware-margin-check":7,"shopware-plugin-report":10,"privacy":13,"framework-focus":16,"framework":19,"framework-principles":22,"imprint":25,"contact":28,"newsletter-confirmed":31,"shopware-agency-b2b":34,"shopware-agency-b2b-configurator":37,"shopware-agency-electronics":40,"shopware-agency-development":43,"shopware-extension-b2b-quote-management":46,"shopware-agency-geo":49,"shopware-agency":52,"shopware-agency-pricing":55,"shopware-cost-calculator":58,"shopware-agency-migration":61,"shopware-agency-seo":64,"shopware-agency-support":67,"shopware-agency-switch":70,"location-hamburg":73,"location-munich":76,"about":79,"about-mission":82,"about-partners":85,"services-consulting":88,"services-development":91,"services":94,"services-optimization":97,"services-growth":100,"insights-ai-sales-channels-shopware":103,"insights-b2b-quote-management-release":106,"insights-b2b-shop-starten-checkliste":109,"insights-comspot-trade-in":112,"insights-ecommerce-deadlines-2026-27":115,"insights-e-invoice-b2b-shopware-xrechnung-zugferd":118,"insights-ecommerce-search-that-finds":121,"insights-warranty-notice-vs-garan-label":124,"insights-warranty-label-modal":127,"insights-warranty-label-shopware-6":130,"insights-handelskoenig-b2b-quotes":133,"insights-measurable-ecommerce-strategy":136,"insights-php2shell-shopware":139,"insights-shopware-5-eol":142,"insights-shopware-6-7-release":145,"insights-shopware-6-8-outlook":148,"insights-shopware-6-plans-pricing-2026":151,"insights-shopware-6-migration-noetig":154,"insights-shopware-gmv-2026":157,"insights-shopware-vs-shopify-2026":160,"insights-shopware-maintenance-retainer-development":163,"insights-withdrawal-button-shopware-6":166,"whitepaper-agentic-commerce-b2b-beschaffung":169,"whitepaper-agenturwechsel-wartungsprojekt":172,"whitepaper-compliance-2026-27":175,"whitepapers":178,"whitepaper-kanalverbund-marktplatz-shop-agentic":181,"whitepaper-shopware-6-boutique-vs-grossagentur-tco":184,"case-comspot-focus":187,"case-converge-focus":190,"case-framily-focus":193,"case-ghs-waescherutsche-focus":196,"case-handelskoenig-focus":199,"case-lupa-focus":202,"case-shifter-focus":205,"case-searchhub-comspot":208,"case-topi-focus":211,"case-xucker-focus":214,"talks-beyond-seo-scuc-2026":217,"talks":220,"talks-shopware-container-hosting-hitc-2026":223,"talks-symfony-cli-docker-scuc-2025":226,"webinars":229,"team-alex-jank":232,"team-benedikt-rillox":235,"team":238},{"de":5,"en":6},"\u002F","\u002Fen",{"de":8,"en":9},"\u002Fshopware-margen-check","\u002Fen\u002Fshopware-margin-check",{"de":11,"en":12},"\u002Fshopware-plugin-report","\u002Fen\u002Fshopware-plugin-report",{"de":14,"en":15},"\u002Fdatenschutz","\u002Fen\u002Fprivacy",{"de":17,"en":18},"\u002Fframework\u002Ffocus","\u002Fen\u002Fframework\u002Ffocus",{"de":20,"en":21},"\u002Fframework","\u002Fen\u002Fframework",{"de":23,"en":24},"\u002Fframework\u002Fprinzipien","\u002Fen\u002Fframework\u002Fprinciples",{"de":26,"en":27},"\u002Fimpressum","\u002Fen\u002Fimprint",{"de":29,"en":30},"\u002Fkontakt","\u002Fen\u002Fcontact",{"de":32,"en":33},"\u002Fnewsletter\u002Fbestaetigt","\u002Fen\u002Fnewsletter\u002Fconfirmed",{"de":35,"en":36},"\u002Fshopware-agentur\u002Fb2b","\u002Fen\u002Fshopware-agency\u002Fb2b",{"de":38,"en":39},"\u002Fshopware-agentur\u002Fb2b-konfigurator","\u002Fen\u002Fshopware-agency\u002Fb2b-configurator",{"de":41,"en":42},"\u002Fshopware-agentur\u002Felektronikhandel","\u002Fen\u002Fshopware-agency\u002Felectronics-retail",{"de":44,"en":45},"\u002Fshopware-agentur\u002Fentwicklung","\u002Fen\u002Fshopware-agency\u002Fdevelopment",{"de":47,"en":48},"\u002Fshopware-agentur\u002Fentwicklung\u002Fb2b-angebotsverwaltung-preisanfragen","\u002Fen\u002Fshopware-agency\u002Fdevelopment\u002Fb2b-quote-management-price-requests",{"de":50,"en":51},"\u002Fshopware-agentur\u002Fgeo","\u002Fen\u002Fshopware-agency\u002Fgeo",{"de":53,"en":54},"\u002Fshopware-agentur","\u002Fen\u002Fshopware-agency",{"de":56,"en":57},"\u002Fshopware-agentur\u002Fkosten","\u002Fen\u002Fshopware-agency\u002Fpricing",{"de":59,"en":60},"\u002Fshopware-agentur\u002Fkosten-rechner","\u002Fen\u002Fshopware-agency\u002Fcost-calculator",{"de":62,"en":63},"\u002Fshopware-agentur\u002Fmigration","\u002Fen\u002Fshopware-agency\u002Fmigration",{"de":65,"en":66},"\u002Fshopware-agentur\u002Fseo","\u002Fen\u002Fshopware-agency\u002Fseo",{"de":68,"en":69},"\u002Fshopware-agentur\u002Fsupport","\u002Fen\u002Fshopware-agency\u002Fsupport",{"de":71,"en":72},"\u002Fshopware-agentur\u002Fwechsel","\u002Fen\u002Fshopware-agency\u002Fswitch",{"de":74,"en":75},"\u002Fstandorte\u002Fhamburg","\u002Fen\u002Flocations\u002Fhamburg",{"de":77,"en":78},"\u002Fstandorte\u002Fmuenchen","\u002Fen\u002Flocations\u002Fmunich",{"de":80,"en":81},"\u002Fueber-uns","\u002Fen\u002Fabout",{"de":83,"en":84},"\u002Fueber-uns\u002Fmission","\u002Fen\u002Fabout\u002Fmission",{"de":86,"en":87},"\u002Fueber-uns\u002Fpartner","\u002Fen\u002Fabout\u002Fpartners",{"de":89,"en":90},"\u002Fleistungen\u002Fberatung","\u002Fen\u002Fservices\u002Fconsulting",{"de":92,"en":93},"\u002Fleistungen\u002Fentwicklung","\u002Fen\u002Fservices\u002Fdevelopment",{"de":95,"en":96},"\u002Fleistungen","\u002Fen\u002Fservices",{"de":98,"en":99},"\u002Fleistungen\u002Foptimierung","\u002Fen\u002Fservices\u002Foptimization",{"de":101,"en":102},"\u002Fleistungen\u002Fwachstum","\u002Fen\u002Fservices\u002Fgrowth",{"de":104,"en":105},"\u002Finsights\u002Fai-verkaufskanaele-shopware","\u002Fen\u002Finsights\u002Fai-sales-channels-shopware",{"de":107,"en":108},"\u002Finsights\u002Fb2b-angebotsverwaltung-shopware-store-release","\u002Fen\u002Finsights\u002Fb2b-quote-management-shopware-store-release",{"de":110,"en":111},"\u002Finsights\u002Fb2b-shop-starten-checkliste-shopware","\u002Fen\u002Finsights\u002Fstart-b2b-store-shopware-checklist",{"de":113,"en":114},"\u002Finsights\u002Fcomspot-trade-in-altgeraete","\u002Fen\u002Finsights\u002Fcomspot-trade-in-device-buyback",{"de":116,"en":117},"\u002Finsights\u002Fe-commerce-fristen-2026-27","\u002Fen\u002Finsights\u002Fe-commerce-deadlines-2026-27",{"de":119,"en":120},"\u002Finsights\u002Fe-rechnung-b2b-shopware-xrechnung-zugferd","\u002Fen\u002Finsights\u002Fe-invoice-b2b-shopware-xrechnung-zugferd",{"de":122,"en":123},"\u002Finsights\u002Fecommerce-suche-die-findet","\u002Fen\u002Finsights\u002Fecommerce-search-that-finds",{"de":125,"en":126},"\u002Finsights\u002Fgewaehrleistungshinweis-vs-garan-label","\u002Fen\u002Finsights\u002Fwarranty-notice-vs-garan-label",{"de":128,"en":129},"\u002Finsights\u002Fgewaehrleistungslabel-modal-zulaessig","\u002Fen\u002Finsights\u002Fwarranty-label-modal-allowed",{"de":131,"en":132},"\u002Finsights\u002Fgewaehrleistungslabel-shopware-6","\u002Fen\u002Finsights\u002Fwarranty-label-shopware-6",{"de":134,"en":135},"\u002Finsights\u002Fhandelskoenig-b2b-angebotsanfragen","\u002Fen\u002Finsights\u002Fhandelskoenig-b2b-quote-requests",{"de":137,"en":138},"\u002Finsights\u002Fmessbare-e-commerce-strategie","\u002Fen\u002Finsights\u002Fmeasurable-ecommerce-strategy",{"de":140,"en":141},"\u002Finsights\u002Fphp-sicherheitsluecke-php2shell-shopware","\u002Fen\u002Finsights\u002Fphp-vulnerability-php2shell-shopware",{"de":143,"en":144},"\u002Finsights\u002Fshopware-5-eol","\u002Fen\u002Finsights\u002Fshopware-5-end-of-life",{"de":146,"en":147},"\u002Finsights\u002Fshopware-6-7-release-update-vorteile","\u002Fen\u002Finsights\u002Fshopware-6-7-release-update-benefits",{"de":149,"en":150},"\u002Finsights\u002Fshopware-6-8-ausblick-roadmap-vorbereitung","\u002Fen\u002Finsights\u002Fshopware-6-8-outlook-roadmap-preparation",{"de":152,"en":153},"\u002Finsights\u002Fshopware-6-lizenzen-kosten-2026","\u002Fen\u002Finsights\u002Fshopware-6-plans-pricing-2026",{"de":155,"en":156},"\u002Finsights\u002Fshopware-6-migration-noetig","\u002Fen\u002Finsights\u002Fshopware-6-migration-necessary",{"de":158,"en":159},"\u002Finsights\u002Fshopware-gmv-berechnung-1-million-grenze","\u002Fen\u002Finsights\u002Fshopware-gmv-calculation-one-million-threshold",{"de":161,"en":162},"\u002Finsights\u002Fshopware-vs-shopify-vergleich-2026","\u002Fen\u002Finsights\u002Fshopware-vs-shopify-comparison-2026",{"de":164,"en":165},"\u002Finsights\u002Fshopware-wartung-retainer-weiterentwicklung","\u002Fen\u002Finsights\u002Fshopware-maintenance-retainer-development",{"de":167,"en":168},"\u002Finsights\u002Fwiderrufsbutton-shopware-6","\u002Fen\u002Finsights\u002Fwithdrawal-button-shopware-6",{"de":170,"en":171},"\u002Fwhitepapers\u002Fagentic-commerce-b2b-beschaffung","\u002Fen\u002Fwhitepapers\u002Fagentic-commerce-b2b-procurement",{"de":173,"en":174},"\u002Fwhitepapers\u002Fagenturwechsel-wartungsprojekt","\u002Fen\u002Fwhitepapers\u002Fagency-switch-maintenance-project",{"de":176,"en":177},"\u002Fwhitepapers\u002Fe-commerce-compliance-2026-27","\u002Fen\u002Fwhitepapers\u002Fe-commerce-compliance-2026-27",{"de":179,"en":180},"\u002Fwhitepapers","\u002Fen\u002Fwhitepapers",{"de":182,"en":183},"\u002Fwhitepapers\u002Fkanalverbund-marktplatz-shop-agentic","\u002Fen\u002Fwhitepapers\u002Fchannel-network-marketplace-shop-agentic",{"de":185,"en":186},"\u002Fwhitepapers\u002Fshopware-6-boutique-vs-grossagentur-tco","\u002Fen\u002Fwhitepapers\u002Fshopware-6-boutique-vs-large-agency-tco",{"de":188,"en":189},"\u002Fcase-studies\u002Fcomspot-focus","\u002Fen\u002Fcase-studies\u002Fcomspot-focus",{"de":191,"en":192},"\u002Fcase-studies\u002Fconverge-focus","\u002Fen\u002Fcase-studies\u002Fconverge-focus",{"de":194,"en":195},"\u002Fcase-studies\u002Fframily-focus","\u002Fen\u002Fcase-studies\u002Fframily-focus",{"de":197,"en":198},"\u002Fcase-studies\u002Fghs-waescherutsche-focus","\u002Fen\u002Fcase-studies\u002Fghs-waescherutsche-focus",{"de":200,"en":201},"\u002Fcase-studies\u002Fhandelskoenig-focus","\u002Fen\u002Fcase-studies\u002Fhandelskoenig-focus",{"de":203,"en":204},"\u002Fcase-studies\u002Flupa-focus","\u002Fen\u002Fcase-studies\u002Flupa-focus",{"de":206,"en":207},"\u002Fcase-studies\u002Fshifter-focus","\u002Fen\u002Fcase-studies\u002Fshifter-focus",{"de":209,"en":210},"\u002Fcase-studies\u002Fshopware-suchintegration","\u002Fen\u002Fcase-studies\u002Fshopware-search-integration",{"de":212,"en":213},"\u002Fcase-studies\u002Ftopi-focus","\u002Fen\u002Fcase-studies\u002Ftopi-focus",{"de":215,"en":216},"\u002Fcase-studies\u002Fxucker-focus","\u002Fen\u002Fcase-studies\u002Fxucker-focus",{"de":218,"en":219},"\u002Fvortraege\u002Fbeyond-seo-scuc-2026","\u002Fen\u002Ftalks\u002Fbeyond-seo-scuc-2026",{"de":221,"en":222},"\u002Fvortraege","\u002Fen\u002Ftalks",{"de":224,"en":225},"\u002Fvortraege\u002Fshopware-container-hosting-hitc-2026","\u002Fen\u002Ftalks\u002Fshopware-container-hosting-hitc-2026",{"de":227,"en":228},"\u002Fvortraege\u002Fsymfony-cli-docker-scuc-2025","\u002Fen\u002Ftalks\u002Fsymfony-cli-docker-scuc-2025",{"de":230,"en":231},"\u002Fwebinare","\u002Fen\u002Fwebinars",{"de":233,"en":234},"\u002Fteam\u002Falex-jank","\u002Fen\u002Fteam\u002Falex-jank",{"de":236,"en":237},"\u002Fteam\u002Fbenedikt-rillox","\u002Fen\u002Fteam\u002Fbenedikt-rillox",{"de":239,"en":240},"\u002Fteam","\u002Fen\u002Fteam",[8,11,9,12],[],{"id":244,"title":245,"author":246,"body":247,"citations":940,"description":951,"draft":952,"extension":953,"image":954,"meta":957,"navigation":958,"ogImage":959,"path":141,"publishedAt":960,"readingTime":961,"robots":959,"schemaOrg":959,"seo":962,"sitemap":966,"squeeze":952,"stem":967,"tags":968,"translationKey":973,"updatedAt":965,"__hash__":974},"insights_en\u002Fen\u002Finsights\u002Fphp-vulnerability-php2shell-shopware.md","PHP2Shell: what the critical PHP flaw means for Shopware stores","benedikt-rillox",{"type":248,"value":249,"toc":918},"minimark",[250,254,282,294,299,345,349,352,355,361,367,377,381,472,481,485,488,500,506,532,535,545,555,569,573,576,579,586,589,610,617,621,628,633,636,661,667,670,674,681,685,688,705,708,712,715,736,740,743,750,754,761,767,774,781,785,788,819,822,826,829,840,844,864,867,871],[251,252,253],"p",{},"On 20 October 2026, details about two critical vulnerabilities in the PHP core\nleaked ahead of the planned patch. The PHP project shipped the security\nreleases on 21 October at 14:00 UTC.",[251,255,256,257,261,262,265,266,269,270,273,274,281],{},"The flaws are tracked as ",[258,259,260],"strong",{},"CVE-2026-109618"," and ",[258,263,264],{},"CVE-2026-109619",", are\npublicly known as ",[258,267,268],{},"\"PHP2Shell\"",", and are rated ",[258,271,272],{},"CVSS v4.0 9.2"," by the PHP\nsecurity team. Germany's federal cyber security agency BSI lists them in its\n",[275,276,280],"a",{"href":277,"rel":278},"https:\u002F\u002Fwww.bsi.bund.de\u002FSharedDocs\u002FCybersicherheitswarnungen\u002FDE\u002F2026\u002F2026-297981-1032.pdf",[279],"nofollow","cyber security warning","\nat criticality 3 of 4 (\"orange\") — measures must be taken immediately.",[251,283,284,285,288,289,293],{},"For Shopware merchants, the most important news is the uncomfortable one:\n",[258,286,287],{},"the flaw is not in Shopware. It is in PHP."," No ",[290,291,292],"code",{},"composer update",", no\nShopware release, and no plugin update closes it.",[295,296,298],"h2",{"id":297},"the-situation-in-brief","The situation in brief",[300,301,302,309,321,327,333,339],"ul",{},[303,304,305,308],"li",{},[258,306,307],{},"What:"," Two remote code execution flaws in the PHP core. The publicly\ndemonstrated attack path is a heap use-after-free in the session upload\nprogress mechanism.",[303,310,311,314,315,320],{},[258,312,313],{},"Who is affected:"," According to security researchers at\n",[275,316,319],{"href":317,"rel":318},"https:\u002F\u002Fsansec.io\u002Fresearch\u002Fphp2shell",[279],"Sansec",", every web server running PHP\n5.4 or later — which in practice means every Shopware, Magento, and\nWooCommerce store, plus WordPress, TYPO3, Joomla!, and Drupal.",[303,322,323,326],{},[258,324,325],{},"Attack prerequisites:"," Per the BSI, neither authentication nor user\ninteraction. An attacker only needs the URL.",[303,328,329,332],{},[258,330,331],{},"Patched:"," PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (21 October 2026).",[303,334,335,338],{},[258,336,337],{},"Not patched by php.net:"," PHP 8.1 and older. Those branches are\nend-of-life and receive no upstream fix. Several distributions backported\nthe fix anyway — details in the update below.",[303,340,341,344],{},[258,342,343],{},"Time pressure:"," Sansec expected mass exploitation within 15 minutes of\nthe release; the BSI expects broad exploitation within hours. The BSI states\nthat no reliable workarounds are known.",[295,346,348],{"id":347},"why-this-affects-every-shopware-store","Why this affects every Shopware store",[251,350,351],{},"Shopware is a PHP application. The vulnerable code sits one layer below it —\nin the interpreter that processes every incoming request before Shopware even\nboots.",[251,353,354],{},"Three consequences are being underestimated right now:",[251,356,357,360],{},[258,358,359],{},"A Shopware update does not help."," The flaw cannot be closed from within the\nstore codebase. The fix has to happen at server, container, or hosting level.",[251,362,363,366],{},[258,364,365],{},"Maintenance mode does not help."," Sansec points this out explicitly: PHP\nparses every request before the application checks its maintenance flag. A\nstore in maintenance mode is just as exploitable as an open one.",[251,368,369,372,373,376],{},[258,370,371],{},"A \"small\" secondary store is not a small risk."," Every PHP instance on the\nsame infrastructure is an entry point: the old Shopware 5 store on a\nsubdomain, the WordPress blog, the staging environment, the forgotten tool\nunder ",[290,374,375],{},"\u002Ftools",". Patching only the main store leaves the door next to it open.",[295,378,380],{"id":379},"which-php-version-needs-which-update","Which PHP version needs which update?",[382,383,384,403],"table",{},[385,386,387],"thead",{},[388,389,390,394,397,400],"tr",{},[391,392,393],"th",{},"PHP branch",[391,395,396],{},"Status",[391,398,399],{},"Fix version",[391,401,402],{},"Action",[404,405,406,421,433,446,458],"tbody",{},[388,407,408,412,415,418],{},[409,410,411],"td",{},"8.5",[409,413,414],{},"active",[409,416,417],{},"8.5.12",[409,419,420],{},"apply immediately",[388,422,423,426,428,431],{},[409,424,425],{},"8.4",[409,427,414],{},[409,429,430],{},"8.4.27",[409,432,420],{},[388,434,435,438,441,444],{},[409,436,437],{},"8.3",[409,439,440],{},"security fixes only",[409,442,443],{},"8.3.36",[409,445,420],{},[388,447,448,451,453,456],{},[409,449,450],{},"8.2",[409,452,440],{},[409,454,455],{},"8.2.35",[409,457,420],{},[388,459,460,463,466,469],{},[409,461,462],{},"8.1 and older",[409,464,465],{},"end-of-life",[409,467,468],{},"no upstream fix",[409,470,471],{},"check for a distro backport, else upgrade or take offline",[251,473,474,475,480],{},"Exact version numbers and release dates are in the\n",[275,476,479],{"href":477,"rel":478},"https:\u002F\u002Fwww.php.net\u002FChangeLog-8.php",[279],"PHP ChangeLog",". One practical note:\ndistributions and hosting providers ship the packages with a delay. The\nrelevant question is not \"has PHP patched?\" but \"is the patch running on my\nserver?\".",[295,482,484],{"id":483},"update-22-october-2026-how-far-back-the-patches-go","Update, 22 October 2026: how far back the patches go",[251,486,487],{},"One day after patch day the question can be answered precisely — and the\nanswer is better for older stores than it looked on 21 October.",[251,489,490,493,494,499],{},[258,491,492],{},"php.net ships fixes for the four supported branches only:"," 8.5.12, 8.4.27,\n8.3.36, and 8.2.35. Every lower version in those branches is vulnerable, and\nPHP 8.1 and older get nothing from the PHP project. How long a branch receives\nsecurity fixes at all is listed under\n",[275,495,498],{"href":496,"rel":497},"https:\u002F\u002Fwww.php.net\u002Fsupported-versions.php",[279],"supported versions",": PHP 8.2 ends\non 31 December 2026, 8.3 on 31 December 2027, 8.4 at the end of 2028, and 8.5\nat the end of 2029. Patching to 8.2.35 today buys two months, not two years.",[251,501,502,505],{},[258,503,504],{},"Distributions and hosting providers patched considerably further back"," —\nthrough backports that leave the PHP version number untouched:",[300,507,508,514,520,526],{},[303,509,510,513],{},[258,511,512],{},"Ubuntu"," ships the fix for 22.04 LTS (PHP 8.1), 24.04 LTS (8.3), and\n26.04 LTS (8.5) under standard support. For 20.04 (7.4), 18.04 (7.2),\n16.04 (7.0), and 14.04 (5.5) it is only available with Ubuntu Pro \u002F ESM.",[303,515,516,519],{},[258,517,518],{},"AlmaLinux"," updated the php:7.2, 7.3, 7.4, 8.0, and 8.2 module streams on\nEL8 and 8.0, 8.1, 8.2, and 8.3 on EL9 — explicitly noting that for retired\nstreams a next time is not guaranteed. RHEL and Rocky have their own\nadvisory status.",[303,521,522,525],{},[258,523,524],{},"Commercial extended support"," (e.g. TuxCare ELS) covers PHP 8.1, 8.0,\n7.0–7.4, and 5.x.",[303,527,528,531],{},[258,529,530],{},"Control panels"," followed: cPanel\u002FEA4 and Plesk rebuilt their PHP\npackages, legacy branches included.",[251,533,534],{},"None of this should be assumed, though: not every vendor backports, and for\nsome distributions older PHP branches were listed as \"no fix planned\" on\nrelease day. The question for the hosting provider stays the same — is there a\npatched package for exactly this PHP version, and is it installed?",[251,536,537,544],{},[258,538,539,540,543],{},"The practical consequence: ",[290,541,542],{},"php -v"," alone proves nothing."," A backport does\nnot raise the version number. A patched Ubuntu PHP still reports 8.1.x, a\npatched AlmaLinux PHP still reports 8.1.32. Verification therefore goes\nagainst the package version and build date:",[546,547,552],"pre",{"className":548,"code":550,"language":551},[549],"language-text","dpkg -l | grep -E '^ii +php[0-9.]*-(cli|fpm)'                                    # Debian\u002FUbuntu\nrpm -q php-cli php-fpm --qf '%{NAME} %{VERSION}-%{RELEASE} %{BUILDTIME:date}\\n'  # RHEL\u002FAlmaLinux\n","text",[290,553,550],{"__ignoreMap":554},"",[251,556,557,558,560,561,560,563,565,566,568],{},"Only with the official Docker images is the version number meaningful again —\nthere the patched tags are ",[290,559,417],{},", ",[290,562,430],{},[290,564,443],{},", and ",[290,567,455],{},".",[295,570,572],{"id":571},"the-hard-case-stores-on-unsupported-php","The hard case: stores on unsupported PHP",[251,574,575],{},"This is where a patch day turns into a strategy topic.",[251,577,578],{},"Shopware 6.7 supports PHP 8.2 to 8.4, and Shopware 6.6 requires at least PHP\n8.2. Stores that are current there get a patch and can apply it.",[251,580,581,582,585],{},"Shopware 6.5 still ran on PHP 8.1 to 8.3. Any 6.5 store still operating on PHP\n8.1 is left without an upstream fix — whether a patch exists at all is up to\nthe distribution. Shopware 5 stores on PHP 7.x are in an\neven worse position — ",[275,583,584],{"href":144},"Shopware 5 has been end-of-life since July\n2024"," and receives no security updates\nitself.",[251,587,588],{},"Those stores have three options, and \"wait and see\" is not among them:",[590,591,592,598,604],"ol",{},[303,593,594,597],{},[258,595,596],{},"Upgrade PHP to a patched branch"," — technically the right move, but it\nrequires a Shopware version that supports the newer PHP.",[303,599,600,603],{},[258,601,602],{},"Temporarily disconnect from the internet"," — the BSI explicitly names\ntaking the web server offline as an option where immediate patching is not\npossible.",[303,605,606,609],{},[258,607,608],{},"A backport from the distribution or an extended-support vendor"," —\nUbuntu Pro\u002FESM, the RHEL-compatible module streams, and ELS vendors such as\nTuxCare covered PHP 8.1, 8.0, and 7.x. Your hosting provider has to confirm\nthis reliably, not \"probably\" — and it extends the store's runway, it does\nnot answer the EOL question.",[251,611,612,613,616],{},"Anyone discovering today that their PHP version belongs in the third row of\nthat table does not have a security problem from today; they have a migration\nproblem from the day before yesterday. Whether and when a\n",[275,614,615],{"href":156},"migration to Shopware 6"," is\nnecessary is a separate article.",[295,618,620],{"id":619},"working-through-it-with-focus","Working through it with F.O.C.U.S.",[251,622,623,624,627],{},"An incident like this is exactly the moment that reveals whether a store is\nbeing operated or merely running. We work through situations like this using\nour ",[275,625,626],{"href":18},"F.O.C.U.S. system"," — not because an acronym makes\nthe patch faster, but because the sequence stops the important things from\nbeing forgotten under pressure.",[629,630,632],"h3",{"id":631},"facts-inventory-before-action","Facts — inventory before action",[251,634,635],{},"The first question is not \"how do we patch?\" but \"where is PHP running at\nall?\". What to record:",[300,637,638,652,655,658],{},[303,639,640,641,644,645,647,648,651],{},"The PHP version ",[258,642,643],{},"per service",": check ",[290,646,542],{}," (CLI) and ",[290,649,650],{},"php-fpm -v","\nseparately — many servers run different builds.",[303,653,654],{},"Every environment: production, staging, preview, development servers.",[303,656,657],{},"Every instance: main store, secondary stores, subdomains, blog, admin tools,\ncron and worker containers.",[303,659,660],{},"The delivery path: distribution package, Docker image, hosting panel, PaaS.",[546,662,665],{"className":663,"code":664,"language":551},[549],"php -v\nphp-fpm -v\nphp -i | grep -i 'session.upload_progress'\n",[290,666,664],{"__ignoreMap":554},[251,668,669],{},"Without that list you are not patching, you are guessing.",[629,671,673],{"id":672},"objectives-a-target-not-an-intention","Objectives — a target, not an intention",[251,675,676,677,680],{},"\"We'll take care of it\" is not an objective. This is: ",[258,678,679],{},"every\ninternet-exposed PHP instance runs a patched version by 22:00 today —\nverified, not assumed."," Plus a second objective: a documented decision for\nevery instance that cannot reach it.",[629,682,684],{"id":683},"constraints-put-the-limits-on-the-table","Constraints — put the limits on the table",[251,686,687],{},"Typical blockers that surface now:",[300,689,690,693,696,699,702],{},[303,691,692],{},"Stores on PHP 8.1 or 7.x with no upgrade path.",[303,694,695],{},"Plugins untested on a newer PHP version.",[303,697,698],{},"No staging environment to validate the patch on first.",[303,700,701],{},"A hosting provider without a defined response time.",[303,703,704],{},"Nobody with deploy permissions reachable.",[251,706,707],{},"Each of these is a decision someone has to make — usually a trade-off between\ndowntime risk and compromise risk. With the PHP2Shell risk profile, patching\nnormally wins.",[629,709,711],{"id":710},"execution-patch-restart-verify","Execution — patch, restart, verify",[251,713,714],{},"The step most often left half done:",[590,716,717,724,730,733],{},[303,718,719,720,723],{},"Update the PHP packages or rebuild the container image\n(",[290,721,722],{},"docker compose build --pull --no-cache",", then restart).",[303,725,726,729],{},[258,727,728],{},"Restart or reload PHP-FPM."," Without a restart the old interpreter stays\nin memory — the package is current, the process is not.",[303,731,732],{},"Verify the version against the running process, not against the package\nlist — and with distro backports against the package version and build\ndate, because the PHP version number stays unchanged there.",[303,734,735],{},"Functional check: login, search, cart, checkout, payment, order export,\nworkers, and cron.",[629,737,739],{"id":738},"scaling-turn-the-emergency-into-a-system","Scaling — turn the emergency into a system",[251,741,742],{},"After the patch, the real question is: how long did it take — and why that\nlong? A team that was done in 20 minutes has a pipeline, an inventory, and\nclear ownership. A team that needed six hours has none of those and will need\nsix hours again next time.",[251,744,745,746,749],{},"The measures that change this are unspectacular: a maintained infrastructure\ninventory, automated patch pipelines, a staging environment that matches\nproduction, monitoring with alerting, and a\n",[275,747,748],{"href":165},"maintenance retainer","\nwith defined response times. None of them prevents the next CVE. Together they\ndecide whether it becomes a routine task or a crisis day.",[295,751,753],{"id":752},"when-immediate-patching-is-impossible","When immediate patching is impossible",[251,755,756,757,760],{},"Several interim measures circulated before the release. For context: a PHP core\ndeveloper stressed that ",[258,758,759],{},"patching is the only reliable mitigation",", and the\nBSI states that no reliable workarounds are known. The steps below buy time;\nthey do not solve the problem:",[546,762,765],{"className":763,"code":764,"language":551},[549],"session.upload_progress.enabled = 0\nsession.use_strict_mode = 1\n",[290,766,764],{"__ignoreMap":554},[251,768,769,770,773],{},"Blocking ",[290,771,772],{},"multipart\u002Fform-data"," requests at web server or WAF level was also\ndiscussed. For a store that is a heavy-handed intervention: admin file\nuploads, image uploads in configurators, and some payment and integration\ncallbacks can break. Defensible as a bridge for a few hours, not as a\npermanent state.",[251,775,776,777,780],{},"And once more, because it is the most common misconception: Shopware's\nmaintenance mode is ",[258,778,779],{},"not"," a mitigation.",[295,782,784],{"id":783},"was-my-store-compromised","Was my store compromised?",[251,786,787],{},"Because the details became public before the patch, there is a window in which\nvulnerable servers were reachable — Sansec documents first exploitation\nattempts on the morning of 21 October, before the patch was published. For\nstores exposed during that window, patching alone is not enough. Things to\ncheck:",[300,789,790,804,807,810,816],{},[303,791,792,793,560,796,799,800,803],{},"New or modified PHP files in the web root, in ",[290,794,795],{},"public\u002F",[290,797,798],{},"custom\u002Fplugins\u002F",",\nand ",[290,801,802],{},"var\u002Fcache"," — compare timestamps against the last deploy.",[303,805,806],{},"Unexpected admin users, integrations, and API keys in Shopware.",[303,808,809],{},"Outbound connections and new cron entries.",[303,811,812,813,815],{},"Web server logs for unusual ",[290,814,772],{}," POST requests.",[303,817,818],{},"Payment and order data for tampering, especially JavaScript injected into\nthe checkout (skimming).",[251,820,821],{},"A confirmed breach is its own process: isolate, preserve forensic evidence,\nrebuild from a clean state, rotate credentials, and assess notification duties\nunder Art. 33 GDPR. Applying a patch on top of a compromised system removes\nthe vulnerability, not the attacker.",[295,823,825],{"id":824},"what-this-day-says-about-store-operations","What this day says about store operations",[251,827,828],{},"PHP2Shell is not a Shopware problem, but it is a perfect stress test for\nShopware operations. The stores that were done within half an hour today did\nnothing magical — they knew which PHP versions were running where, had a way\nto update them, and had someone allowed to do it.",[251,830,831,832,835,836,839],{},"That is precisely the scaling phase in\n",[275,833,834],{"href":18},"F.O.C.U.S.",": go-live is not the success, it is the\nstarting point of responsibility. Security updates do not belong in the\n\"when there's time\" category but in the same one as uptime and checkout\nconversion — measurable, owned, plannable. The same ingredients show up in our\n",[275,837,838],{"href":150},"Shopware 6.8 outlook",":\ndocument the infrastructure, automate core tests, reserve release windows.",[295,841,843],{"id":842},"conclusion","Conclusion",[590,845,846,849,852,855,858,861],{},[303,847,848],{},"Check the PHP version of every internet-exposed instance — CLI and FPM\nseparately.",[303,850,851],{},"Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart PHP-FPM.",[303,853,854],{},"Verify against the running process, not the package list — with backports,\nagainst the package version and build date.",[303,856,857],{},"Instances on PHP 8.1 or older: check for a distro backport (Ubuntu\nPro\u002FESM, RHEL streams, ELS), otherwise decide on an upgrade path or take\nthem offline.",[303,859,860],{},"If exposed during the leak window: run a compromise assessment.",[303,862,863],{},"Then draw the lesson — inventory, pipeline, retainer.",[251,865,866],{},"The vulnerability was not avoidable. The response time is.",[629,868,870],{"id":869},"official-sources","Official sources",[300,872,873,879,885,891,898,905,911],{},[303,874,875],{},[275,876,878],{"href":277,"rel":877},[279],"BSI cyber security warning 2026-297981-1032 — critical PHP vulnerabilities",[303,880,881],{},[275,882,884],{"href":477,"rel":883},[279],"PHP ChangeLog 8.x — security releases",[303,886,887],{},[275,888,890],{"href":496,"rel":889},[279],"PHP: supported versions",[303,892,893],{},[275,894,897],{"href":895,"rel":896},"https:\u002F\u002Fubuntu.com\u002Fblog\u002Fphp2shell-vulnerability-fixes-available",[279],"Ubuntu Security: php2shell — available fixes incl. ESM",[303,899,900],{},[275,901,904],{"href":902,"rel":903},"https:\u002F\u002Falmalinux.org\u002Fblog\u002F2026-10-21-php2shell-cve-2026-109618-cve-2026-109619\u002F",[279],"AlmaLinux: php2shell — patched PHP packages released",[303,906,907],{},[275,908,910],{"href":317,"rel":909},[279],"Sansec: critical PHP RCE CVE-2026-109618 and CVE-2026-109619",[303,912,913],{},[275,914,917],{"href":915,"rel":916},"https:\u002F\u002Fdocs.shopware.com\u002Fen\u002Fshopware-6-en\u002Fupdate-guides\u002Fupdate-guide-shopware-67",[279],"Shopware 6.7 update guide — supported PHP versions",{"title":554,"searchDepth":919,"depth":919,"links":920},2,[921,922,923,924,925,926,934,935,936,937],{"id":297,"depth":919,"text":298},{"id":347,"depth":919,"text":348},{"id":379,"depth":919,"text":380},{"id":483,"depth":919,"text":484},{"id":571,"depth":919,"text":572},{"id":619,"depth":919,"text":620,"children":927},[928,930,931,932,933],{"id":631,"depth":929,"text":632},3,{"id":672,"depth":929,"text":673},{"id":683,"depth":929,"text":684},{"id":710,"depth":929,"text":711},{"id":738,"depth":929,"text":739},{"id":752,"depth":919,"text":753},{"id":783,"depth":919,"text":784},{"id":824,"depth":919,"text":825},{"id":842,"depth":919,"text":843,"children":938},[939],{"id":869,"depth":929,"text":870},[941,943,945,946,947,949,950],{"name":942,"url":277},"BSI cyber security warning 2026-297981-1032: critical PHP vulnerabilities",{"name":944,"url":477},"PHP ChangeLog 8.x — security releases of 21 October 2026",{"name":910,"url":317},{"name":890,"url":496},{"name":948,"url":895},"Ubuntu Security: php2shell (CVE-2026-109618 and CVE-2026-109619)",{"name":904,"url":902},{"name":917,"url":915},"Two critical RCE flaws in PHP (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) affect every Shopware store. What to do now — and why no Shopware update fixes them.",false,"md",{"src":955,"alt":956},"\u002Fimages\u002Finsights\u002Fphp2shell-shopware.png","Benedikt Rillox explaining the critical PHP2Shell vulnerability and the patched PHP versions for Shopware stores",{},true,null,"2026-10-21",12,{"title":963,"description":964,"articleModifiedTime":965},"PHP2Shell: critical PHP flaw and Shopware","CVE-2026-109618 and CVE-2026-109619 hit every Shopware store at the PHP level. Patched versions, immediate steps, and a process that holds up.","2026-10-22",{"loc":141,"lastmod":965},"en\u002Finsights\u002Fphp-vulnerability-php2shell-shopware",[969,970,971,972],"Shopware","Security","Technology","Maintenance","insights-php2shell-shopware","bawqbIoPPF-dQ9GxgkG-aOYGRlgELCt1XBS6WM54Mpk",{"id":976,"title":977,"alternateName":959,"bio":978,"body":979,"description":1149,"events":1150,"extension":953,"heroIllustration":1152,"image":1154,"meta":1157,"name":1156,"navigation":958,"ogImage":959,"path":237,"projects":959,"publishedAt":959,"robots":959,"role":1158,"sameAs":1159,"schemaOrg":959,"seo":1163,"sitemap":1165,"slug":246,"socials":1166,"squeeze":952,"stem":1167,"talks":959,"translationKey":1168,"updatedAt":959,"__hash__":1169},"team_en\u002Fen\u002Fteam\u002Fbenedikt-rillox.md","Benedikt Rillox — Founder & Strategist","Benedikt is managing partner of nuonic Digital, e-commerce consultant, and developer. Since 2009 he has been designing, building, and guiding digital platforms — from code through product ownership to strategic leadership.",{"type":248,"value":980,"toc":1140},[981,985,991,994,997,1000,1004,1007,1010,1013,1016,1019,1023,1026,1029,1032,1055,1058,1062,1065,1068,1071,1088,1092,1095,1098,1104,1107,1111,1114,1117,1120,1124,1127,1130],[295,982,984],{"id":983},"about-benedikt-rillox","About Benedikt Rillox",[986,987,988],"blockquote",{},[251,989,990],{},"To me, technology is not a cost item — it's a competitive advantage.",[251,992,993],{},"I'm Benedikt Rillox, managing partner of nuonic Digital, e-commerce consultant, and developer.",[251,995,996],{},"Since 2009 I have been designing, building, and guiding digital platforms. My path led from hands-on software development through product ownership and technical team leadership into entrepreneurial responsibility.",[251,998,999],{},"That's why I know e-commerce from very different perspectives: from the code, from product development, from budget responsibility, and from strategic leadership. Today I combine these experiences to build commerce systems that don't just work technically, but measurably move businesses forward.",[295,1001,1003],{"id":1002},"my-path-in-e-commerce","My path in e-commerce",[251,1005,1006],{},"I started out as a developer for web and e-commerce projects using technologies like Shopware, TYPO3, PHP, and Symfony. During that time I delivered solutions for smaller companies as well as for well-known brands and corporations — including Unilever, Paul Hewitt, and Framily.",[251,1008,1009],{},"At A-Z Gartenhaus my role evolved from Shopware developer to product owner. There I helped build and lead a ten-person development team and was responsible for the strategic evolution of the commerce platform and its connected third-party systems.",[251,1011,1012],{},"For the Legero United group I took on budget responsibility as product owner and coordinated the technical development of the Superfit, legero, and Think! shops.",[251,1014,1015],{},"As tech lead for ByteClub I planned and built the commerce platforms of the group with brands like COMSPOT, Shifter, GfBD, and IM.F.B. Further projects included ongoing support and the Shopware 6 rebuild for Xucker, as well as the design and development of a Shopware payment plugin for topi that digitizes B2B leasing and buy-on-invoice.",[251,1017,1018],{},"These stations taught me that successful commerce projects never consist of technology alone. They combine architecture, processes, people, and clear business goals.",[295,1020,1022],{"id":1021},"from-development-to-strategy","From development to strategy",[251,1024,1025],{},"I am a developer, a strategist, and a problem solver.",[251,1027,1028],{},"I can dive deep into technical details without losing sight of the actual goal: What impact should a solution have for the company, its people, and its customers?",[251,1030,1031],{},"Today my focus is on designing, building, and continuously evolving demanding Shopware systems. Among other things, that includes:",[300,1033,1034,1037,1040,1043,1046,1049,1052],{},[303,1035,1036],{},"technical and strategic e-commerce consulting,",[303,1038,1039],{},"software and Shopware development,",[303,1041,1042],{},"architecture and system integration,",[303,1044,1045],{},"product ownership and project management,",[303,1047,1048],{},"performance and stable operations,",[303,1050,1051],{},"automation and process optimization,",[303,1053,1054],{},"technical team leadership and collaboration with agencies.",[251,1056,1057],{},"Across more than 25 client projects I have seen what makes digital initiatives fail — and what makes them succeed. Good technology needs a clear direction, realistic requirements, and the courage to make decisions.",[295,1059,1061],{"id":1060},"i-dont-build-shops-just-so-theyre-online","I don't build shops just so they're online",[251,1063,1064],{},"A shop can work technically and still be too slow, too complicated, or economically ineffective. That's why at nuonic we don't just look at individual features. We look at the whole system: architecture, processes, integrations, performance, customer journey, and the ability to grow in the future.",[251,1066,1067],{},"I don't believe in best practices when they merely mean copying what everyone else is already doing. I believe in solutions that fit a company's business model, its team, and its actual goals.",[251,1069,1070],{},"That also means asking uncomfortable questions:",[300,1072,1073,1076,1079,1082,1085],{},[303,1074,1075],{},"Does this feature really need to exist?",[303,1077,1078],{},"Does it solve a relevant problem?",[303,1080,1081],{},"Will the system remain manageable in the long run?",[303,1083,1084],{},"Does the investment support a concrete business goal?",[303,1086,1087],{},"Can the platform grow without collapsing under its own complexity?",[295,1089,1091],{"id":1090},"responsibility-begins-after-go-live","Responsibility begins after go-live",[251,1093,1094],{},"To me, go-live is not a success. It's the beginning of responsibility.",[251,1096,1097],{},"Only in day-to-day operations does a platform prove whether it truly holds up: whether it stays stable, whether the team can work with it efficiently, and whether it can evolve without unnecessary friction.",[251,1099,1100,1101],{},"That's why my work doesn't end with the handover. That's where the real value creation begins: ",[258,1102,1103],{},"Optimize. Automate. Scale.",[251,1105,1106],{},"I don't think in short-term projects, but in commerce systems that carry their weight for the long run. Technology shouldn't just cover today's needs — it should open up new possibilities.",[295,1108,1110],{"id":1109},"clarity-is-part-of-working-together","Clarity is part of working together",[251,1112,1113],{},"Good results don't come from saying yes to every idea. That's why I also say no — to bad requirements, to short-term thinking, and to projects without a discernible direction.",[251,1115,1116],{},"I prefer working with decision-makers who take ownership. With teams that are ready to genuinely change things instead of merely managing existing problems. And with companies that see technology as an investment — not as a necessary cost item.",[251,1118,1119],{},"That's not always comfortable. But it creates clarity, protects budgets, and leads to better results.",[295,1121,1123],{"id":1122},"what-i-stand-for","What I stand for",[251,1125,1126],{},"I don't want to simply be busy. I want to create impact.",[251,1128,1129],{},"With nuonic we build commerce systems for companies that want to grow — faster, more stable, and more profitable.",[251,1131,1132,1133,1136,1137,1139],{},"Others talk about digitalization. We deliver it.",[1134,1135],"br",{},"\nOthers plan. We build.",[1134,1138],{},"\nOthers wait. We go.",{"title":554,"searchDepth":919,"depth":919,"links":1141},[1142,1143,1144,1145,1146,1147,1148],{"id":983,"depth":919,"text":984},{"id":1002,"depth":919,"text":1003},{"id":1021,"depth":919,"text":1022},{"id":1060,"depth":919,"text":1061},{"id":1090,"depth":919,"text":1091},{"id":1109,"depth":919,"text":1110},{"id":1122,"depth":919,"text":1123},"Projects, references, talks and events by Benedikt Rillox — founder and strategist at nuonic Digital, e-commerce consultant and developer since 2009.",[1151],"omr-festival-2026",{"src":1153,"alt":554},"\u002Fimages\u002Fteam\u002Fdefender.png",{"src":1155,"alt":1156},"\u002Fimages\u002Fteam\u002Fbenedikt-rillox.jpg","Benedikt Rillox",{},"Founder & Strategist",[1160,1161,1162],"https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fbenedikt-rillox-4122b183\u002F","https:\u002F\u002Fgithub.com\u002Fbenediktrillox","https:\u002F\u002Fwww.xing.com\u002Fprofile\u002FBenedikt_Rillox",{"title":977,"description":1149,"articleModifiedTime":1164},"2026-08-14",{"loc":237,"lastmod":1164},{"linkedin":1160,"github":1161},"en\u002Fteam\u002Fbenedikt-rillox","team-benedikt-rillox","Io4iBFT4BZaQMrk8v8Woi1nCjxdLOcoLJReSh5tJVUg",1792653173978]