PHP2Shell on Developer Machines: Homebrew, MAMP, Laragon and XAMPP

As of 23 October 2026, every major local PHP tool offers PHP builds with the PHP2Shell fixes: Homebrew, MAMP PRO, Laragon, XAMPP for Windows and Local. Most carry PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, though some offer only one or two of those branches. The gaps are older PHP versions and a few bundles that haven't been rebuilt.

The direct answer: a PHP stack on a laptop is at much lower risk than a public web server, because these flaws are attacked over the network and most local tools are not reachable from the internet. Lower risk is not no risk. Update anyway, and treat any local stack you have exposed (shared on a network, opened with a tunnel or live link, or used as a real server) exactly like production.

This guide covers each tool's fix, how to update it, how to check which PHP you are really running, and when a local machine stops being "just local."

How Much Risk Is a Local Stack?

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) can be triggered by a web request that needs no login. That is what makes public servers urgent. A development stack that listens only on your own machine is much harder to reach.

The vendors that commented agree on the framing. Local's team says "Local does not expose your site to the internet by default, so the risk of running older versions locally is lower." MAMP says "MAMP PRO is designed exclusively for local development. We strongly advise against using it as a publicly accessible production server."

Our reading, from those statements: the local stacks that matter are the ones you have exposed. Watch for these:

• Sharing features. Local's Live Links make a local site public. WP Engine staff said on 21 October that Local Hub and Live Links environments "are all patched now."
• Tunnels and port forwarding. Any tool that gives your local site a public address puts its PHP on the internet for as long as it is open.
• Office networks. A stack that listens on your network, not just your own machine, can be reached by anything else on that network.
• "Temporary" servers. A MAMP or XAMPP machine quietly serving an intranet or a client demo is a server, whatever it was installed for.

There is a second reason to update: habits travel. A project developed on unpatched PHP 8.1 tends to get deployed on 8.1. Keeping local PHP on a fixed, supported branch keeps the whole pipeline honest. Our guide to security patching best practices covers building that into your routine.

Fixed Versions by Tool

Homebrew

Homebrew's core formulas picked up the fixed releases within hours on 21 October. Update and upgrade the way Homebrew documents (replace php with php@8.3 or another formula you use):

brew update
brew upgrade php

Homebrew's manual says brew upgrade upgrades "outdated, unpinned packages," so if you pinned PHP to keep it from changing, unpin it first or it will be skipped.

Then restart whatever runs PHP. If you use Homebrew's PHP-FPM service:

brew services restart php

Homebrew documents this as "Stop (if necessary) and start the service formula immediately." If you load PHP into Apache instead, using the LoadModule line from Homebrew's php instructions, restart Apache. If you only use php artisan serve, php -S or another built-in server, stop it and start it again.

Old PHP on macOS. Homebrew core no longer maintains PHP 8.1, and its php@8.1 formula was not updated. Many developers use the shivammathur/homebrew-php tap for old versions. It rebuilt php@8.1, php@8.0, php@7.4 and php@5.6 on 21 October from "security release sources," and its php@8.1 formula now builds from a backports repository. The commits don't name the CVEs, so treat the fix as likely rather than confirmed, and move projects to 8.2 or newer.

MAMP and MAMP PRO

MAMP's home page notice says: "The PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are now available for MAMP PRO 7 for macOS and MAMP PRO 5 for Windows."

• macOS: "The new PHP versions can be added directly within the application." There is no new app download; the app version stays 7.4.0.
• Windows: "The updated PHP versions are included in the latest installation package," which is MAMP and MAMP PRO 5.0.7, dated 23 October 2026.

After adding the new version, switch each host to it, then stop and start MAMP's servers. Remove old PHP versions you no longer need so nothing falls back to them.

Laragon

Laragon's release 8.8.0, published 22 October, says: "Update PHP 8.3 to the latest version, 8.3.36 (Critical Security Fixes)." It covers only the 8.3 branch. If you added other PHP versions to Laragon yourself, replace them with the fixed Windows builds from windows.php.net (NTS or TS to match what you have), and restart Laragon's services. Windows-specific details, including which build to pick, are in our PHP2Shell on Windows and IIS guide.

XAMPP

The XAMPP download page now offers "XAMPP for Windows 8.5.12, 8.4.27 & 8.3.36." Apache Friends has published no security notice, no date and no upgrade steps. Two things to know:

• The page no longer lists Linux or macOS XAMPP builds. If you run an older XAMPP on those systems, there is no fixed XAMPP package to install. Move to Homebrew, MAMP or a container.
• "XAMPP for Browsers" still ships PHP 8.3.12, which predates the fix.

XAMPP keeps its own copy of PHP inside the XAMPP folder, and Apache Friends gives no steps for moving to the new installer. Before you install it, back up your project files (the htdocs folder) and export your databases, so you can restore them if anything is overwritten.

Local (WP Engine)

WP Engine staff posted in the Local community forum on 22 October: "New patched PHP versions are now available in Local for all OSs No Local update is needed." New versions appear "in the Custom Environment page: 8.2.35 8.3.36 8.4.27 8.5.12," and you "Update existing Local sites by clicking "Update" in the PHP row on the site info screen."

That last step is per site. Local won't move an existing site to the fixed build until you click Update. For older PHP, staff say "No patches for earlier versions are available from the PHP foundation as they are end of life." Intel Mac users should note that "macOS 14 is the minimum version required for Intel builds of PHP."

Check Which PHP You Are Really Running

Developer machines often have several copies of PHP: the system one, Homebrew's, one inside MAMP or XAMPP, and more in containers. The one in your terminal may not be the one serving your project.

• Terminal: which php (macOS and Linux) or where php (Windows) shows which php comes first. php -v shows its version.
• The project: load a temporary phpinfo page through the same URL you use for the project, read the version, then delete it.
• The new setting: PHP's manual says memory_hard_limit_percent exists only in 8.2.35, 8.3.36, 8.4.27, 8.5.12 and later, and that if it "is not recognized, the PHP version in use is affected." php -i | grep memory_hard_limit_percent should print a line on a fixed build. Don't use this test on backported builds of old branches, which may not have it.

Our guide on how to check your PHP version covers every method, and the PHP2Shell version lookup tells you whether a version is fixed. After updating, restart the PHP process; our guide to restarting PHP workers explains why the old one keeps running otherwise.

Containers and Shared Dev Environments

If your local environment runs in Docker, the PHP inside the image is what counts, and updating your laptop does nothing for it. Pull or rebuild from a fixed base image and recreate the containers. Our PHP2Shell and Docker guide has the steps.

Staging sites deserve the same treatment as production. They are often public, often forgotten, and often hold a copy of real data. Our guide to WordPress staging sites covers how to keep them separate and protected.

For a developer-focused summary of the advisories, versions and settings in one place, see our PHP2Shell technical summary for developers.

Conclusion

As of 23 October 2026, Homebrew, MAMP PRO, Laragon, XAMPP for Windows and Local all offer PHP builds with the PHP2Shell fixes, though not every tool covers every branch, and old PHP is mostly left behind. A stack that only listens on your own machine is low risk, but update it anyway, switch each project to the fixed version, restart PHP, and treat anything you've exposed through a tunnel, live link or network share as a server. If a "local" machine has quietly become a production server and you want help moving it somewhere safer, our emergency PHP patching team can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions