Shopware Services - PHP security update and root CA bundle update
Affects
- Completed · October 21, 2026 at 6:00 PMUTCMaintenance has completed successfully
- Update · October 21, 2026 at 4:00 PMUTC
Maintenance is still in progress.
We will post an update here as soon as all our services have been patched.
- In progress · October 21, 2026 at 1:57 PMUTC
Maintenance is now in progress. Services are being updated.
- Planned · October 21, 2026 at 11:04 AMUTC
The PHP project is releasing a new version today at 16:00 CEST to fix two security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Once the release is available, we will rebuild and redeploy our affected app services to apply the fix.
As part of the same maintenance, we will deploy an updated root CA bundle to these services that removes the compromised eMudhra certificates. More details: https://blog.cloudflare.com/emudhra-certificate-compromise/
Updates are rolled out without downtime, so we don't expect any impact on your shops or apps. We will post an update here once the rollout is complete.