Urgent PHP Security Patches: How Shopware Hosters Responded to a Critical CVSS 9.2 Vulnerability

Urgent PHP Security Patches: How Shopware Hosters Responded to a Critical CVSS 9.2 Vulnerability

On October 21, 2026, the Shopware community was alerted to a critical PHP security vulnerability (CVSS 9.2, specifically CVE-2026-109618 and CVE-2026-109619) with patches scheduled for release at 4 PM MEZ. This announcement sparked a lively discussion among Shopware users, developers, and merchants about their hosting providers' responses and the immediate impact on their online stores.

The Threat: Critical PHP Vulnerabilities

The core of the issue revolved around two severe vulnerabilities, one of which was identified as potentially affecting the PHP upload progress display function (upload_progress.enabled). Exploiting this could lead to the execution of malicious code, posing a significant risk to any website running on affected PHP versions, including Shopware stores.

Hoster Responses: A Mixed Bag of Proactivity and Caution

The forum thread quickly became a hub for users to share updates on how their respective hosters were handling the situation:

• Swift Action: Some hosting providers, like IONOS and all-inkl.com, were praised for their rapid response. Users reported that IONOS had updated to PHP 8.4.27 by early morning on October 22, while all-inkl.com also confirmed patching to PHP 8.5.12. One user, who managed their own hosting, noted they had all current PHP versions patched by the evening of the announcement, ensuring no downtime.
• Proactive Mitigation: All-inkl.com specifically communicated a preventative measure: they temporarily deactivated the upload_progress.enabled function server-side for all PHP versions. This allowed customer sites to remain online while awaiting the official patches. Another common temporary fix mentioned was hosters setting the memory_limit to -1 to prevent exploitation.
• Temporary Offline Periods: Timme Hosting took a more cautious approach, proactively taking all PHP-based websites offline until the patches were fully applied. While this resulted in temporary downtime (around 3 hours for one user), it was lauded by some as the most secure option, ensuring no shop was exposed to the vulnerability.
• Varying Patching Speeds: Not all hosters were equally fast. Profihost, for instance, fixed versions 8.2, 8.3, 8.4, and 8.5 by 8:20 PM on October 21 but was still working on backports for older PHP versions (5.6 to 8.1). This highlighted a potential ongoing risk for shops running on legacy PHP environments.
• Best Practices for Downtime: One user reminded the community about Google's recommendation to use an HTTP 503 ("Service Unavailable") status code when a website is temporarily taken offline for maintenance, ensuring SEO integrity.

Community Takeaways

The discussion underscored the critical importance of:

• Responsive Hosting: The value of a hosting provider that acts swiftly and transparently during security crises.
• Staying Updated: The inherent risks of running outdated PHP versions, as patching efforts for older versions can be slower or incomplete.
• Vigilance Post-Patch: A strong recommendation for merchants to thoroughly check their shops after updates, especially if they were online with unpatched versions, to ensure no exploitation occurred.

Ultimately, the "madness" (as one user put it) passed, with most Shopware stores returning to normal operations thanks to the rapid deployment of patches. This event served as a stark reminder of the dynamic nature of web security and the need for constant vigilance.