In short: Shopware 5 has been without regular support for a long time. But the PHP vulnerability php2shell, fixed today, affects every Shopware 5 store as well. Official PHP fixes exist only for PHP 8.2 to 8.5, and PHP 8.2 runs out at the end of 2026. With version 5.7.20 and the official PHP 8.3 code base, Shopware 5 can run on PHP 8.3, which receives security updates until the end of 2027. The catch is your installed plugins: most no longer get updates and need to be reviewed and adapted.
The situation: Shopware 5 is at the end of the road, but not written off
Shopware ended development of Shopware 5 years ago in favour of Shopware 6. Still, many Shopware 5 stores are online, often running reliably for many years.
Even after the official end of support, Shopware kept releasing maintenance updates. The last official release is Shopware 5.7.20 from June 5, 2025. Since September 2026, the official Shopware 5 repository on GitHub has been marked as no longer maintained. No further updates should be expected.
What php2shell means for Shopware 5 stores
On October 21, 2026, the PHP team fixed two critical security vulnerabilities in PHP. They let attackers run their own code on the server without logging in. The flaw is in PHP itself, not in Shopware. That is why every store is affected, no matter how well it is maintained. You will find all the details and a plain-language explanation in my article php2shell: Critical PHP Vulnerability.
For Shopware 5 this is especially tricky. Many Shopware 5 stores still run on PHP 7.4, 8.0 or 8.1. There is no official PHP update for these versions. Only these were patched:
- PHP 8.5 (8.5.12), security updates until December 31, 2029
- PHP 8.4 (8.4.27), security updates until December 31, 2028
- PHP 8.3 (8.3.36), security updates until December 31, 2027
- PHP 8.2 (8.2.35), security updates only until December 31, 2026
A store on PHP 8.1 or older therefore stays exposed, and that for a flaw Cloudflare already reports being attacked.
The way forward: Shopware 5.7.20 and PHP 8.3
To get your store back onto a PHP version that receives security updates, it needs the current Shopware 5.7 code base:
- Shopware 5.7.20 is the last official release and runs with PHP up to 8.2.
- PHP 8.3 compatibility was added by the Shopware team in the official 5.7 branch and tested there against PHP 8.3. The changelog lists it as part of the next version, 5.7.21.
Important for planning: there is no ready-made installation package for this PHP 8.3 code base and no update via the backend. It has to be applied technically, for example via Git and Composer. This is not a click in the backend but a job for a developer.
With 5.7.20 and the PHP 8.3 code base, your store can switch to patched PHP 8.3.36. That gives you PHP security updates until the end of 2027.
If you need a quick fix: If your store already runs on Shopware 5.7, PHP 8.2.35 can be a short bridge. It is officially supported for 5.7.20 and patched against php2shell. But only until December 31, 2026. The move to PHP 8.3 should still be done by the end of the year.
The real risk: your plugins
Shopware itself is ready for PHP 8.3. Your plugins usually are not. Many Shopware 5 plugins are no longer maintained by their vendors. There is no support and there are no updates, and some vendors no longer exist.
This also applies to custom extensions and modified themes. Code written years ago for PHP 7 often no longer runs cleanly on PHP 8.3. Typical consequences after the PHP switch:
- The store or individual pages only show an error message or stay blank.
- Payment or shipping plugins break during checkout.
- Integrations with ERP systems, marketplaces or newsletter tools stop transferring data.
- Individual backend modules no longer open.
That is why every move to PHP 8.3 needs a review of all installed plugins. Each plugin has to be tested on PHP 8.3 and adapted where needed. Plugins you no longer need should be removed while you are at it. Every plugin removed is one less that can cause problems.
How to make the switch safely
- Take stock: record the Shopware version, the PHP version and all installed plugins.
- Create a test copy: copy the store and database to a test environment. Nothing gets tried out on the live store.
- Update Shopware: to 5.7.20 with the PHP 8.3 code base.
- Review and adapt plugins: test every plugin and the theme on PHP 8.3 and fix errors.
- Test core processes: registration, cart, checkout with all payment methods, emails, integrations.
- Go live: back up, apply the update, switch the PHP version to 8.3 with your hosting provider, check everything again.
If you are still on Shopware 5.6 or older, you first need to get to 5.7. That is a bigger step, because a lot changed under the hood with 5.7. In that case, plugins and theme are almost always affected.
And in the long run?
Moving to PHP 8.3 buys you time: PHP security updates until the end of 2027. But Shopware 5 itself no longer gets updates. If a vulnerability is found in Shopware 5 or a plugin, nobody fixes it automatically.
So use that time to plan the move to Shopware 6. I explain why it pays off in Why You Should Migrate from Shopware 5 to Shopware 6 Now. What it costs is covered in Shopware Migration: Costs and Process.
Checklist for Shopware 5 store owners
- Check the Shopware version in the backend (Settings > System info).
- Check the PHP version in your hosting account or with your provider.
- Make a list of all installed and active plugins.
- Create a test copy of the store.
- Plan the update to Shopware 5.7.20 with the PHP 8.3 code base.
- Have plugins reviewed and adapted for PHP 8.3.
- Switch to patched PHP 8.3.36.
- As a bridge, PHP 8.2.35 at most, and only until December 31, 2026.
- Plan the migration to Shopware 6 for 2027.
Frequently asked questions
Can't I just switch the PHP version with my hosting provider?
I advise against it. Shopware 5.7.20 on its own is officially supported only up to PHP 8.2, and old plugins often break. In the worst case, your store goes down while customers are trying to order.
My store runs on PHP 8.2. Do I still need to do anything?
Yes, twice. First, the update to PHP 8.2.35 must be installed. Second, PHP 8.2 ends on December 31, 2026. After that, there are no more security updates for 8.2.
Are there still updates for my old plugins?
For most Shopware 5 plugins, no. That is why they need to be reviewed and adapted where needed. With custom-built plugins, this almost always works. With purchased plugins, it depends on whether the code is accessible.
Is my store permanently safe after moving to PHP 8.3?
Against php2shell, yes, once patched PHP 8.3.36 is running. But Shopware 5 itself no longer gets updates. PHP 8.3 is therefore a solid bridge, not a permanent solution.