Shopware security patches only protect a shop if someone installs them. On 21 October 2026, Shopware’s status page told SaaS customers that a PHP security update was done and that no action was needed. The notice lists only Shopware SaaS.
If your shop runs on your own hosting, that update is somebody’s job, and the job needs a name.
What Shopware said on 26 October
Five days later, Shopware published guidance for self-hosted shops. It now recommends keeping the Security Plugin installed, activated and up to date, even when the platform itself is fully up to date. The earlier advice was to use it mainly when a platform update couldn’t go out right away.
Two other points matter for owners. The plugin “does not replace updates to PHP, third-party dependencies, extensions, or Shopware itself.” And once an advisory is public, Shopware says it sees automated exploitation attempts “within days,” so it advises against deferring the work to the next weekly or monthly maintenance window.
The post is addressed to agencies, merchants and extension partners alike. Each of them, Shopware says, should have a process in place to apply security fixes promptly. A process needs a person to run it.
The three layers of a shop
A shop has three places where a security fix can land.
- Shopware. When the Security Plugin covers a fix, that’s enough for me, and I keep it installed and current. When it doesn’t, I update the shop itself.
- PHP and the server. The plugin doesn’t touch this layer. Someone with server access has to upgrade PHP.
- Your other plugins. Each vendor ships its own updates, and a developer maintains your custom ones.
If a hosting company, an agency and a freelancer all touch the shop, and nobody has written down who owns which layer, each can reasonably assume it’s someone else.
What the PHP flaws looked like in practice
In October, two PHP flaws known as php2shell, CVE-2026-109618 and CVE-2026-109619, needed a PHP update. A Shopware plugin can’t fix a flaw in PHP, so the Security Plugin wasn’t the tool. On a client’s server I upgraded PHP and then audited the shop for signs of an attack.
Varonis, a security vendor, lists the patched releases as 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and says PHP 8.1 and older have no official release. The PHP changelog lists all four. If your shop runs an old PHP version, ask your host about it.
How it works with an agency or on a retainer
When an agency brings me in as its freelancer, it asks me to check the status of its client’s shop. I check the shop and tell the agency what I find.
On a retainer, it works differently. I check the shop myself, without anyone asking, and send an update email. Nobody has to remember to ask.
Four questions for whoever looks after your shop
- Who watches Shopware and PHP security releases, and how do they find out?
- Who can change PHP on your server, and how fast?
- Who decides to patch outside the regular maintenance window, and who pays for those hours?
- Who checks the shop afterwards for signs of an attack?
If you can’t answer all four, the job probably has no owner yet. A read-only review of your Shopware version, plugin list and logs shows where the shop stands today, and I describe one in my store audit post.
What my maintenance retainer covers
It starts at EUR 550 a month and includes 10 hours of development for bug fixes, plugin conflicts and small changes. I check for plugin updates and Shopware updates ahead of time, without being asked, and install them. You get a same-day response, and I send you an update email.
Frequently asked questions
Is the Shopware Security Plugin enough on its own? For Shopware’s own security fixes it’s what I rely on, and Shopware now recommends keeping it installed, activated and up to date. It doesn’t replace updates to PHP, third-party dependencies, extensions or Shopware itself, so those updates still need an owner. When it doesn’t cover a fix, I update the shop or PHP myself.
Does Shopware patch self-hosted shops for me? No. Shopware’s status notice about the October PHP update lists only Shopware SaaS, where Shopware says it applies platform updates and security patches automatically. On your own hosting, someone you appoint has to do it.
What does a Shopware maintenance retainer cost? Mine starts at EUR 550 a month and includes 10 hours of development. I check for plugin updates and Shopware updates ahead of time, without being asked, and install them. You get a same-day response.
What should I do if my shop runs an old PHP version? Ask your host which PHP version you run and whether it still gets official security fixes. Varonis reports that PHP 8.1 and older have no official release for the php2shell flaws.
If nobody owns patching on your shop, get in touch. I take this on as a Shopware freelance developer. More work like this is in my case studies.
