XAMPP PHP version and PHP2Shell: does your local dev stack matter?

Is XAMPP affected by PHP2Shell?

Yes. XAMPP bundles its own PHP, and every version on offer is older than the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619). The Apache Friends download page lists XAMPP 8.2.12 for Windows and Linux and 8.2.4 for macOS, and the Windows release folders end in November 2023 with PHP 8.2.12, 8.1.25 and 8.0.30. The fixed releases are:

If your XAMPP Apache loads PHP as a module (mod_php), note that PHP’s advisory names that the highest-risk setup.

Does a local XAMPP install matter for PHP2Shell?

Only if something other than your own computer can reach it. An attacker has to send HTTP requests to the server. Apache Friends’ FAQ says XAMPP “is not meant for production use but only for development environments” and is configured to be as open as possible, with the warning aimed at installs reachable from the network. Check these cases:

• Same Wi-Fi or office LAN: in Apache’s own words, a Listen line with only a port listens “on all interfaces”, so other devices on the network may connect unless a firewall blocks them.
• Port forwarding, tunnels or a public server: then the internet can reach it, and you’re running an unpatched public PHP server.
• Only 127.0.0.1: outsiders can’t reach it; someone would already need access to your machine.

How do I check XAMPP’s PHP version?

Check the PHP that Apache serves. The FAQ points to http://localhost/xampp/phpinfo.php, which shows the version and the loaded php.ini (\xampp\php\php.ini on Windows). php -v in XAMPP’s shell reports the command-line SAPI instead; php_sapi_name() returns apache2handler for Apache’s module. Details are in the check PHP version guide.

Has Apache Friends released a fixed XAMPP?

No, not as of 22 Oct 2026. Apache Friends’ newest blog post and downloads are still the PHP 8.2.12 release, and a GitHub issue opened on 21 October 2026 asking for a PHP2Shell update had no reply from the maintainers when we checked. Get PHP itself only from php.net, and treat “patched XAMPP” downloads from anywhere else with suspicion.

How do I fix or contain a vulnerable XAMPP?

1. Keep it local. In \xampp\apache\conf\httpd.conf, change Listen 80 to Listen 127.0.0.1:80, and do the same for the HTTPS port in the SSL config if you use it. Remove any port forwarding or tunnel.
2. Stop it when idle. Stop Apache in the XAMPP Control Panel when you’re not developing.
3. Move to a fixed PHP for local work. The official Docker PHP images were updated to 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (pull request); see Docker PHP image. On Windows without a bundle, see update PHP on Windows.
4. Never use XAMPP for a live site. Production PHP should come from a source that ships security fixes.

How do I restart Apache and verify?

After editing Listen, stop and then start Apache rather than reloading: Apache’s documentation warns that changing Listen on a restart can fail. Then open the site from another device on the same network: it should no longer connect, while http://localhost/ still works on your machine. Use the PHP version checker to read your version.

What if I can’t stop using this XAMPP yet?

Keep it on localhost and add PHP’s stopgaps in php.ini, such as turning off session.upload_progress.enabled and lowering post_max_size, then restart Apache. They block specific paths only; see the CVE-2026-109618 workaround.

What about older XAMPP bundles with PHP 7.4, 8.0 or 8.1?

They’re older still, and PHP offers only source patches for 7.4, 8.0 and 8.1, with no Windows builds. Move projects to 8.2 or later; see PHP end of life, the PHP2Shell patch guide and the PHP2Shell checker.