Shopware 6.5 is running against a deadline that is hard to find in writing: according to the Shopware release calendar, the line only receives security fixes until the end of February 2027, and since June 2025 these fixes no longer arrive as patch releases as a rule, but through the security plugin (Shopware release calendar). The plugin closes flaws in Shopware's own code, but not in Symfony or Twig (Shopware security plugin docs). How narrow the margin has become was shown by the security releases in August and September 2026: core patches were only published for 6.6 and 6.7. This article puts the date into context, shows what the plugin does and does not cover, and describes a schedule for moving a shop to Shopware 6.7 by the end of February 2027. Our Shopware agency is ready to help with the implementation.
What the release calendar shows for Shopware 6.5
Shopware does not publish its support commitments as a list of dates, but as a chart on the page with the release policy. The page describes four states: maintained version, extended support, security fixes only and end of life. For the state "Security fixes only", Shopware specifies that the fixes are provided via a security plugin and not as a direct patch update (Shopware release calendar). This is exactly the state of the last minor version 6.5.8.0 and its patch levels. For older 6.5 minor versions, the chart has shown no bar since May 2025 (Shopware release calendar); anyone still running one of them needs the update to 6.5.8.19 first anyway.
An end date is not given anywhere as text. We measured the bars of the chart on 5 October 2026: the "Security fixes only" section for 6.5.8.0 ends on 28 February 2027 (Shopware release calendar). The open directory endoflife.date lists the same date as the end of security support for 6.5 (endoflife.date). Two routes, one result: that is enough as a basis for planning, but it is not a written commitment.
This fits a sentence Shopware placed below the chart: transitions between support phases are tied to major releases, not to fixed timelines (Shopware release policy). What this means for 6.6 and 6.7 is described in the article Shopware 6.8 announced for 2027. For 6.5, the calendar is nevertheless the only published information, and it differs fundamentally from the newer lines in one respect: 6.5 no longer receives core patches, only fixes via the plugin.
The chart draws each phase as a bar on a time axis. The position of the end of the bar gives 28 February 2027 (Shopware release calendar). At the same point, the chart also ends extended support for the last 6.6 minor version 6.6.10.0 (Shopware release calendar), which Shopware has tied to the release of 6.8 (Shopware announcement, November 2025). Shopware can adjust the chart at any time, for example if 6.8 is postponed. Check the calendar again before every budget or scheduling decision instead of relying on a date noted down once.
How Shopware 6.5 has been supported so far
Shopware 6.5 was released on 3 May 2023 (endoflife.date). With 6.6.0.0, Shopware introduced a new release policy in March 2024 that promised major versions up to two years of support, starting with 6.5 (Shopware release notes 6.6.0.0). The 6.5 line thus moved into extended support and continued to receive patch releases. With the stable version 6.7.0.0 of 17 June 2025, this section ended: since then, 6.5 no longer receives extended maintenance, and 6.6 took over the role of the extended support version (Shopware release notes 6.7.0.0).
Shopware had announced this beforehand. The release notes for 6.5.8.18 of 12 May 2025 state that this would be the last patch for the 6.5 series, together with the request to install the security plugin and keep it updated (Shopware release notes 6.5.8.18). A year later, 6.5.8.19 nevertheless followed, as an explicit exception that we will come to below.
| Phase | Period | How security fixes arrive |
|---|---|---|
| Maintained version and extended support | 3 May 2023 to 17 June 2025 | Core patch releases, the last regular one 6.5.8.18 of 12 May 2025 |
| Security fixes only | 17 June 2025 to 28 February 2027 (end according to the release calendar) | Security plugin 2.x, no patch release |
| Exception | 2 June 2026 | Patch release 6.5.8.19 because of a flaw in Twig |
| After the end in the calendar | from 1 March 2027 | The calendar shows no further support |
In practice, this means that since June 2025, 6.5 has depended on a single regular support channel. How reliable it is depends on what the plugin can cover.
What the security plugin covers and what it does not
The security plugin (SwagPlatformSecurity) backports security fixes to existing installations without Shopware itself having to be updated. It is free, maintained by Shopware, and version 2.x for Shopware 6.5 is marked as maintained in the compatibility table (Shopware security plugin docs). Shopware explicitly describes the plugin as a bridge until a regular update, not as a replacement for it (Shopware security plugin docs).
The most important limit is stated right in the first section of the documentation: security issues in dependencies such as Symfony or Twig are not covered by the plugin and require an update of the dependency or of Shopware (Shopware security plugin docs). If composer.lock pins an outdated library, the installation stays vulnerable even with the plugin active. Shopware 6.5.8.19 ties Symfony to the 6.4 line and Twig to version 3.26.0 or newer within 3.x (GitHub shopware/shopware). Symfony 6.4 receives security fixes until November 2027 (symfony.com). However, such fixes only reach a 6.5 shop through a Composer update in the project, and only as long as the new library version fits the constraints of 6.5.
The second limit concerns the plugin itself. In some cases, a vulnerability cannot be fixed safely or completely through the plugin for every affected version; the advisory concerned then names an update as the way forward (Shopware security plugin docs). For a line without patch releases, this is the critical case, because an update within 6.5 no longer exists.
| Type of flaw | Security plugin 2.x for 6.5 | Route for 6.6 and 6.7 |
|---|---|---|
| Bug in Shopware's own code | yes, as soon as a fix is published in the plugin | Core patch release, alternatively the plugin |
| Flaw in Symfony or Twig | no, only via a Composer or Shopware update | Composer update or patch release |
| Flaw that cannot be fully fixed via the plugin | no, the advisory requires an update | Patch release |
| Period | until 28 February 2027 according to the release calendar | tied to the release of the next major version |
August and September 2026: core patches only for 6.6 and 6.7
The two security rounds of late summer show how the difference plays out. On 25 August 2026, 6.6.10.23 and 6.7.13.1 were released; the release notes for 6.6.10.23 list nine fixed vulnerabilities, including an escape from the sandbox for App Scripts (Shopware release notes 6.6.10.23). On 16 September 2026, 6.6.10.25 and 6.7.14.1 followed, both labeled as security releases (Shopware release notes 6.6.10.25). There was no 6.5 version on either date; the latest release of the line remains 6.5.8.19 of 2 June 2026 (endoflife.date).
| Advisory | Flaw | Rating | Affects 6.5 | Core patch | Fix for 6.5 |
|---|---|---|---|---|---|
| GHSA-6qhw-38wm-7g7h | Escape from the App Script sandbox | critical, CVSS 9.6 | yes, from 6.5.4.0 | 6.6.10.23 and 6.7.13.1 | Security plugin 2.0.22 |
| GHSA-xj2c-8fw5-mr6m | Takeover of admin accounts via manipulated password reset links | critical, CVSS 9.3 | yes, all versions up to 6.6.10.22 | 6.6.10.23 and 6.7.13.1 | Security plugin 2.0.22 |
| GHSA-r432-q883-wgvf | Webhooks bypass the permissions for event data | critical, CVSS 9.6 | yes, 6.5.x named explicitly | 6.6.10.25 and 6.7.14.1 | Security plugin 2.0.23 |
All three advisories rate the flaw as critical. The App Script flaw allowed a malicious or compromised app to execute arbitrary PHP functions and operating system commands with the permissions of the web server process; 6.5 from 6.5.4.0 as well as 6.6 and 6.7 up to the fixed versions are affected (GitHub advisory GHSA-6qhw-38wm-7g7h). Through the second flaw, an unauthenticated attacker could redirect the password reset link of an administrator to a foreign domain (GitHub advisory GHSA-xj2c-8fw5-mr6m). The webhook advisory explicitly names 6.5.x and earlier versions as affected (GitHub advisory GHSA-r432-q883-wgvf).
For 6.5, Shopware followed up on the same day in both rounds: version 2.0.22 of the security plugin of 25 August 2026 contains, among others, the fixes for the App Script and the password flaw, version 2.0.23 of 16 September 2026 the fix for the webhook flaw (Shopware Store, security plugin changelog). Fairness requires saying so: anyone who kept the plugin up to date was hardly worse off in these rounds than with a patch release. The limitation lies in the period and in the limits of the plugin, and together they make up the deadline.
In both security rounds, the fix for 6.5 arrived on the day of the advisory (Shopware Store, security plugin changelog). This requires the plugin to be installed, updates to be applied promptly and the cache to be cleared afterwards. With the end of support according to the release calendar, this route also ends.
The Twig flaw of June 2026: where the plugin does not help
What happens when a flaw lies outside Shopware's code was shown by 6.5.8.19 of 2 June 2026. The release contained a security fix in Twig, and Shopware wrote that the security plugin could not protect the installation as usual in this case; a Twig update was necessary, rolled out with the patch (Shopware release notes 6.5.8.19). Shopware called the release an absolute exception and, in its own words, published it as a courtesy, although 6.5 was no longer supported (Shopware release notes 6.5.8.19).
Technically, the exception sits in one line of composer.json: 6.5.8.18 required Twig from version 3.20, 6.5.8.19 from version 3.26.0 (GitHub shopware/shopware). The release notes of the newer lines show that a new Twig version needs more than a changed version constraint: 6.7.12.1 of 6 July 2026 brought compatibility with Twig 3.28 (Shopware release notes 6.7.12.1), 6.6.10.27 of 24 September 2026 compatibility with Twig 3.29 (Shopware release notes 6.6.10.27). For 6.6 and 6.7, such adjustments arrive as regular patches. For 6.5, this channel no longer exists.
Whether Shopware will make another exception for a future flaw in Twig or Symfony is open. It is not something you can plan with.
A shop that stays on 6.5 depends, for flaws in dependencies, on the fixed library running without changes to the core, or on Shopware publishing another release as a courtesy. Neither can be predicted. Moving to 6.7 by the end of February 2027 removes this dependency.
PHP: the second schedule, less pressing for 6.5
Alongside Shopware, the PHP calendar is running. Shopware 6.5.8.19 allows PHP 8.1, 8.2 and 8.3 (GitHub shopware/shopware). PHP 8.1 has received no security fixes since 31 December 2025, PHP 8.2 only until 31 December 2026, PHP 8.3 until 31 December 2027 (php.net). A 6.5 shop on PHP 8.1 is therefore already running on an unsupported runtime today, one on PHP 8.2 from the turn of the year, almost two months before the end in the Shopware calendar. Anyone already using PHP 8.3 has no PHP deadline before the end of 2027.
The PHP argument therefore only carries limited weight for 6.5. It becomes important during the upgrade: Shopware 6.6 requires PHP 8.2 (Shopware release notes 6.6.0.0), and 6.7.15.0 allows PHP 8.2 to 8.5 (GitHub shopware/shopware). Shopware recommends raising PHP to the minimum version of the new Shopware version before a major update (Shopware update docs). PHP 8.3 is therefore the bridge: it is allowed for 6.5, 6.6 and 6.7 and receives security fixes beyond the planned upgrade window. How a PHP switch works in detail is described in the article on the end of support for PHP 8.2 using WordPress as an example; the test steps apply to shops in the same way.
| PHP branch | Security fixes until (php.net) | Shopware 6.5.8.19 | Shopware 6.6.10.28 | Shopware 6.7.15.0 |
|---|---|---|---|---|
| 8.1 | 31 Dec 2025 | allowed | not allowed | not allowed |
| 8.2 | 31 Dec 2026 | allowed | allowed | allowed |
| 8.3 | 31 Dec 2027 | allowed | allowed | allowed |
| 8.4 | 31 Dec 2028 | not allowed | allowed | allowed |
The Shopware columns are based on the PHP constraints in the composer.json of the respective version (GitHub shopware/shopware). The release notes for 6.6.10.28 list PHP 8.2 and 8.4 as tested (Shopware release notes 6.6.10.28), those for 6.7.15.0 PHP 8.2, 8.4 and 8.5 (Shopware release notes 6.7.15.0). PHP 8.3 is allowed but not listed there. Anyone using 8.3 as the bridge should therefore test the shop on staging with exactly this version before switching live.
Why the target is 6.7 and not 6.6
Shopware recommends updating from every major version to the next one (Shopware update docs). For a 6.5 shop, the route therefore leads through 6.6. Stopping there is hardly worthwhile, though: according to Shopware, extended support for 6.6 runs until 6.8 is available, and 6.8 is planned for 2027 (Shopware announcement, November 2025). A shop arriving on 6.6 in February 2027 might face the next jump within the same year.
6.7 is the current line. For self-hosted installations, minor releases occur monthly (Shopware release policy), and with them come notices about 6.8 that can be worked through step by step. The breaks along the way are known: 6.6 raised Symfony to version 7 and PHP 8.2 to the minimum version (Shopware release notes 6.6.0.0), 6.7 switched the build of the Administration from webpack to Vite and removed the compatibility layer for Vue 2 (Shopware release notes 6.7.0.0). What this means for custom extensions is described in the article on plugin migration to Shopware 6.7.
- PHP 8.3 on 6.5: switch the runtime beforehand, while the shop is still running on 6.5.
- 6.5.8.19 and an up-to-date security plugin: align the starting point so that the upgrade begins on a known basis.
- Intermediate stage 6.6: update to the last 6.6 version on the staging environment, run the migrations and check extensions in their 6.6 versions.
- Target stage 6.7: move to the current minor version and test extensions and the theme in their 6.7 versions.
- Go-live: repeat the rehearsed procedure in the agreed maintenance window and then plan PHP 8.4 as the next step.
Schedule until the end of February 2027
Between mid-October and the end of February there are a good four months, with Black Week and the Christmas season in the middle. During this time, hardly any merchant likes to change anything in the live shop. The plan therefore arranges the work so that as little as possible changes in the live system until the turn of the year and the switch happens in January.
- October: inventory. Which 6.5 version and which PHP version are running, which extensions from the Store and which custom ones are installed, which interfaces are connected to the shop? In parallel, set up a staging environment with anonymized data, as described in the article Shopware staging without real customer data.
- November: introduce PHP 8.3 on staging and then live, if not already done. For each extension, clarify whether versions for 6.6 and 6.7 exist; port custom plugins and the theme.
- December: rehearse the upgrade from 6.5 via 6.6 to 6.7 on the staging environment several times, each time from a fresh copy. In the live shop, only updates of the security plugin.
- January: acceptance on staging with the most important processes: search, cart, checkout, payment methods, interfaces and emails. Then the go-live in a quiet time window.
- February: buffer for follow-up work. Anyone who does not finish in January has the last opportunity here before the end in the calendar.
After the go-live, the normal maintenance rhythm begins: minor versions of the 6.7 line at regular intervals, security releases promptly. How updates can be applied with low risk is shown in the article installing Shopware updates safely. And because 2027 brings deadlines beyond Shopware, it is worth looking at the 2027 deadline calendar for online shops.
Custom themes override Twig blocks of the Storefront. If a block changes between 6.5 and 6.7, the override works differently or not at all. Comparing the overridden blocks therefore belongs in November, not in January. What to watch out for in terms of accessibility is described in the article Custom Shopware theme: do not build in accessibility barriers.
Until the upgrade: what a 6.5 shop needs now
Until the switch is live, the plugin remains the only regular route for fixes to Shopware's code. For it to hold, a few routines are needed:
- Security plugin installed and on the latest 2.x version; clear the cache after every plugin update so that new fixes are loaded (Shopware security plugin docs).
- Run
composer auditregularly and update only the reported packages selectively rather than all of them (Shopware security plugin docs). - Follow the advisories in Shopware's GitHub repository and check whether a plugin fix is available for 6.5 or an update is required.
- Restrict the permission to create webhooks to trusted administrators and integrations, as the advisory on the webhook flaw names as an interim measure (GitHub advisory GHSA-r432-q883-wgvf).
- Install apps only from trusted sources and review installed apps regularly.
- Back up the database and files regularly and try the restore at least once on staging.
A shop's dependencies are a risk of their own, independent of Shopware. How Composer and npm packages can be updated in a controlled way is described in the article on supply chain attacks on the shop stack. An overview of the other layers of protection is given in IT security in e-commerce.
How XICTRON supports the move away from 6.5
We implement the switch as a project with a fixed procedure: inventory, rehearsal on staging, go-live in the agreed window. The scope depends mainly on the number of custom extensions and on the theme, which is why every project starts with an inventory.
Inventory
Record version, PHP, extensions, theme and interfaces and define the route to 6.7 for each extension, as part of our consulting.
Adapting plugins and theme
Move custom plugins to Symfony 7 and the Vite build of the Administration and compare theme overrides, through our programming services.
Upgrade via 6.6 to 6.7
Rehearse the upgrade on staging, test the most important processes and carry out the go-live in the agreed maintenance window.
Operation after the upgrade
Updates, security releases and monitoring in ongoing operation, on request with our Shopware hosting.
If you would like to know how big the step is for your shop, get in touch with us. For a first assessment, the Shopware version, the PHP version and the list of installed extensions are usually enough.
This article draws on the Shopware release calendar and release policy (chart measured on 5 October 2026), the Shopware release notes for 6.5.8.18, 6.5.8.19, 6.6.0.0, 6.6.10.23, 6.6.10.25, 6.6.10.27, 6.6.10.28, 6.7.0.0, 6.7.12.1 and 6.7.15.0, the Shopware documentation on the security plugin and on performing updates, the changelog of the security plugin in the Shopware Store, the Shopware announcement on 6.8 from November 2025, the security advisories GHSA-6qhw-38wm-7g7h, GHSA-xj2c-8fw5-mr6m and GHSA-r432-q883-wgvf in the GitHub repository shopware/shopware, the composer.json of versions 6.5.8.18, 6.5.8.19, 6.6.10.28 and 6.7.15.0, the release data from php.net and symfony.com and the open directory endoflife.date. All information retrieved on 5 October 2026.
It keeps running. According to the release calendar, however, the supply of security fixes via the security plugin ends on 28 February 2027 (Shopware release calendar). For flaws that become known afterwards, the calendar no longer provides for a fix. The risk therefore does not jump on a single date, but grows with every new flaw.
For flaws in Shopware's own code, it delivered fixes promptly in 2026, most recently with version 2.0.23 of 16 September 2026 (Shopware Store, security plugin changelog). It does not cover flaws in Symfony or Twig (Shopware security plugin docs). It makes sense as a bridge until the upgrade, not as a permanent solution.
Shopware recommends going through each major version individually (Shopware update docs). In practice, this means: 6.6 as an intermediate stage on the staging environment, 6.7 as the target. As a rule, only the rehearsed state on 6.7 goes live.
Because extended support for 6.6 is tied to the release of 6.8, which is planned for 2027 (Shopware announcement, November 2025). Anyone who stays on 6.6 may therefore face the next major jump within the same year.
As a rule, PHP 8.3. It is allowed for 6.5.8.19, 6.6 and 6.7 (GitHub shopware/shopware) and receives security fixes until 31 December 2027 (php.net). After the upgrade to 6.7, PHP 8.4 is the obvious next step.
This depends mainly on the number of custom extensions, on the theme and on the interfaces. A shop with few extensions from the Store is typically switched faster than one with several custom plugins. Only the inventory gives a reliable estimate, which is why it should take place in October.