PHP2Shell: What Shopware Shop Owners Need to Do About CVE-2026-109618 and CVE-2026-109619
Two critical PHP core bugs allow unauthenticated remote code execution on almost every PHP version since 5.4. PHP fixed them on 21 October 2026. What is affected, how to check your shop, and what the workarounds do and don't cover.