# Shopware 5 PHP Version After PHP2Shell: Securing Old Shops > Shopware 5 often runs on an old PHP version. Check your status, close PHP2Shell with interim protection and plan the migration properly. Source: https://phpsos.de/en/plattformen/shopware-5/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 **In short:** After PHP2Shell, the Shopware 5 PHP version is the most important question. Many of these shops run on PHP 8.1 or older, for which the PHP project no longer provides official updates. You therefore need a confirmed backport or interim protection and a firm plan for the migration. ## Why Shopware 5 shops need a particularly close look PHP2Shell comprises two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619. According to the trade press, almost all versions going back to PHP 5.4 are affected. Official fixes exist only for PHP 8.2 to 8.5; for 7.4, 8.0 and 8.1 there are only minimal source backports. Shopware 5 is the predecessor generation of Shopware 6. Grown shops with many custom plugins in particular have stayed there, often on the PHP version that was current at the last major rebuild. Whether your specific Shopware 5 version still receives security updates from the manufacturer can be checked on shopware.com. What applies to old PHP versions is summarised in [PHP 8.1 and older](https://phpsos.de/en/php2shell/php-8-1-und-aelter/). ## Checking the Shopware 5 PHP version in the backend and on the server In the Shopware 5 backend, **Settings > System info** shows the server environment, including the PHP version, and checks the requirements. This is the version the backend runs on. You cannot see there whether your host has applied a backport; the number can stay the same although the system is patched. | PHP status | Situation with PHP2Shell | Next step | |---|---|---| | 8.2 to 8.5 | Official fix available | Update, restart, evidence | | 7.4, 8.0, 8.1 | Only minimal source backports | Have the backport confirmed, plan the migration | | 7.3 and older | No fix from the PHP project | Interim protection immediately, bring the migration forward | Which PHP versions your Shopware 5 version and your plugins can handle is determined from the manufacturer's system requirements and by testing on a copy of the shop. ## Where malicious code likes to sit in Shopware 5 - **config.php** in the main directory: database credentials in plain text. - **custom/plugins/** and **engine/Shopware/Plugins/Community/** as well as **Local/**: newer and older plugin locations, often with custom developments that are no longer maintained. - **themes/Frontend/**: templates and JavaScript of the shop's own theme, popular for skimmers in the checkout. - **web/cache/**: compiled theme files that, once manipulated, are delivered to every visitor. - **media/** and **files/**: images, downloads and documents, no PHP files. - **var/log/**: logs that you should secure before any change. Harmless check for PHP files in places where none belong: ```bash find media files web/cache -type f -name "*.php" find themes custom -name "*.php" -newermt "2026-10-17" ``` The backend is located at `/backend`. Check the user management there for unknown accounts and, if possible, restrict access to known networks. The plugin manager also deserves a look: unknown or recently installed plugins that nobody commissioned are a clear warning sign. Old shops come with a practical problem. Often nobody knows exactly any more which plugins were customised, and the original agency can no longer be reached. A comparison with the plugin vendors' original packages is then the only reliable way to detect changes. While you are at it, also document which plugins the shop really needs; that will help later with the migration. > **Act now:** > If your Shopware 5 shop runs on PHP 8.1 or older and your host cannot confirm a backport, implement the interim measures from php.net immediately. The BSI (German Federal Office for Information Security) recommends temporarily taking web servers offline if an update is not immediately possible. ## Interim protection until the migration Until PHP is updated or the shop has been migrated, the measures from php.net reduce the risk without offering complete protection. They belong in the server configuration, not in `.user.ini`: ```ini ; set in the FPM pool as php_admin_value or php_admin_flag memory_limit = -1 post_max_size = 32M upload_max_filesize = 16M session.upload_progress.enabled = 0 ``` Then restart all PHP processes. A filter placed in front can help additionally; details are under [Immediate measures without a patch](https://phpsos.de/en/php2shell/sofortmassnahmen-ohne-patch/). ## What a Shopware 5 update achieves and what it does not An update within Shopware 5 can close known bugs in the shop and sometimes enable newer PHP versions. It does not patch PHP, does not remove foreign files and does not prove that the shop is clean. The switch to Shopware 6 is a project with data transfer, a new theme and new plugins. How we structure such migrations is described in [PHP 8.1 and older: migration](https://phpsos.de/en/leistungen/php-migration-legacy/). Keep the result in writing: PHP status, backport confirmation and date of the restart. You will need this documentation if your insurer, payment provider or data protection officer asks questions. ## How does PHP SOS help? - We determine the PHP version, package status and backport situation of your Shopware 5 server. - We implement interim protection in the server configuration and restart all processes. - We check plugins, theme, cache and users for traces of an attack. - Together with you, we draw up a roadmap: a PHP upgrade on Shopware 5 as an intermediate step, or a direct migration. ## Frequently asked questions **Which PHP version does Shopware 5 need?** That depends on the exact Shopware 5 version. Check the system requirements in the documentation on shopware.com for your installed version. What matters for PHP2Shell is whether your PHP version still receives security updates. **Can I simply switch Shopware 5 to PHP 8.3?** Only if your Shopware version and all plugins support that PHP version. Otherwise errors in the checkout or in the backend are likely. Test the switch on a copy of the shop before you go live. **Is migrating to Shopware 6 just an update?** No. Shopware 6 is a new platform with different technology, different plugins and a different theme system. Data can be transferred, but plugins and design have to be rebuilt. **What if the migration takes months?** Until then, the shop needs patched PHP via your distribution or host, the interim measures from php.net and, where appropriate, a filter placed in front. This reduces the risk but does not replace the migration. ## Sources - [php.net: Security announcements](https://www.php.net/) - [Supported PHP versions](https://www.php.net/supported-versions.php) - [Shopware](https://www.shopware.com/) - [TechTarget: PHP2Shell](https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released)