PHP security update and root CA bundle update

Affects

Shopware PaaS Native

Application Services

CompletedOctober 21, 2026 at 5:55 PMUTC
Maintenance has completed successfully.
In progressOctober 21, 2026 at 3:44 PMUTC
Maintenance has completed successfully.
CompletedOctober 21, 2026 at 3:44 PMUTC
We need to extend the maintenance, as we are waiting for the artfefacts to be available.
In progressOctober 21, 2026 at 2:00 PMUTC
Maintenance is now in progress
PlannedOctober 21, 2026 at 9:44 AMUTC
The PHP project is releasing a new version today at 16:00 CEST to fix two security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Once the release is available, we will rebuild and redeploy all applications to apply the fix.
As part of the same maintenance, we will also deploy an updated root CA bundle that removes the compromised eMudhra certificates. More details: https://blog.cloudflare.com/emudhra-certificate-compromise/
This should not have any impact on your applications.

Shopware - PHP security update and root CA bundle update – Maintenance details