Are patched PHP versions addressing CVE-2026-109618 and CVE-2026-109619 available for Local on Windows yet? We’re using Local 10.2.0+7022 with PHP 8.2.29. Local reports that it is up to date, but the PHP update option only offers 8.2.30+1, and none of the fixed versions appear in the version list. Is there a supported manual update method, or do we need to wait for Local to release updated PHP packages? Is there an estimated release date?

Hi @ederdem! Patches are released and available for updating now. Read more here: [image] PHP vulnerabilties PHP2Shell Support New patched PHP versions are now available in Local for all OSs No Local update is needed. The latest Local version has not changed: https://localwp.com/releases/ Create sites with the latest PHP by choosing one of these versions in the Custom Environment page: 8.2.35 8.3.36 8.4.27 8.5.12 Update existing Local sites by clicking “Update” in the PHP row on the site info screen. @Henkk No patches for earlier versions are available from the PHP foundation as they are end of life: PHP: Supported…

Patched PHP Versions for PHP2Shell: Availability and Update Options on Windows

Support

Nick-B October 22, 2026, 1:03pm 2

Hi @ederdem!

Patches are released and available for updating now. Read more here:

Topic		Replies	Views
PHP vulnerabilties PHP2Shell Support	8	477	October 23, 2026
Update Preferred Version to 8.2.35 Support	10	126	October 30, 2026
Request for PHP 8.2.35 support in LocalWP 10.1.2 on Windows Support	2	71	October 22, 2026
Local für Windows: PHP 8.2 mit Sicherheitskorrekturen – Paket und Wechselweg Support windows	1	50	September 14, 2026
Support: New update php 8.2.10? Feature requests installation , local-updater , php , windows-11	1	338	September 15, 2023

Patched PHP Versions for PHP2Shell: Availability and Update Options on Windows

Related topics