PHP2Shell statement record · Platform
No public statement located as of 23 October 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
No public statement located as of at: https://www.shopware.com/en/changelog/ (newest 6.7.15.1 and 6.6.10.29, 7 Oct 2026); https://www.shopware.com/en/news/ (newest 13 Oct 2026); https://www.shopware.com/en/security/ (404); https://forum.shopware.com/latest; https://forum.shopware.com/t/kritische-sicherheitsluecken-cvss-9-2-in-php-release-heute-16-00-uhr/109751 (community thread, no Shopware staff post visible); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Shopware 6 and Shopware 5 listed Vulnerable citing requirement docs only).
No shopware AG statement on PHP2Shell found in the changelog, news or forum as of the last check. The community forum thread Kritische Sicherheitslücken (CVSS 9.2.) in PHP: Release heute 16:00 Uhr
(opened 21 Oct 2026 by user MichaelF, 33 replies) carries no post marked as Shopware staff on the page read. NCSC-NL inventory lists Shopware 6 and Shopware 5 as Vulnerable on the basis of PHP requirements, not a vendor statement.
differs
Yes—Shopware deployments running vulnerable PHP are affected, and Shopware has patched its SaaS offering. Self-hosted installations need their own PHP update. As of October 23, 2026: | Deployment | Status | |---|---| | Shopware SaaS | Patched. Shopware marked its update complete on October 21, 2026, at 14:33 UTC, stating: “All shops have been updated to the latest PHP
no status named
Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Shopware: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Is Shopware Affected? ✅ Yes — Shopware Is Affected The flaws are in the PHP engine itself, so Magento, Shopware, and WooCommerce stores are affected even when their own code is clean. This is a critical
no status named
Yes. Shopware is affected when it runs on a vulnerable, web-serving PHP runtime, but the vulnerabilities are in PHP itself—not in Shopware code. The NCSC-NL software list explicitly marks both Shopware 5 and Shopware 6 as vulnerable in that deployment scenario. PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026 in: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12
no status named
Shopware is indirectly affected because it runs on top of the PHP runtime, which contains the core vulnerabilities CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell). However, the vulnerability is not a flaw in Shopware's own application code, but rather a memory-safety and remote code execution bug in the underlying PHP interpreter . Affected Status Vulnerable: Any Shopware instance running on
no status named
Are Shopware stores affected? Yes, Shopware stores running on vulnerable versions of the PHP core engine are affected because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability in the underlying PHP language runtime rather than Shopware's own application code. Even if a Shopware installation is clean and up to date, the underlying server environment remains at risk if it runs
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
A badge is issued once a public statement is located and verified on the company's own domain or verified official account.
Shopware's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Shopware and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy