# PHP Security Patch Issue?

**URL:** <https://community.localwp.com/t/php-security-patch-issue/52676>\
**Category:** Support\
**Created:** [October 22, 2026, 6:15am UTC](https://community.localwp.com/t/php-security-patch-issue/52676 "2026-10-22T06:15:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eno1](https://avatars.discourse-cdn.com/v4/letter/e/f475e1/32.png) [@Eno1](https://community.localwp.com/u/Eno1)\
**Post date:** [October 22, 2026, 6:15am UTC](https://community.localwp.com/t/php-security-patch-issue/52676/1 "2026-10-22T06:15:10Z")

</div>

### What issue or error are you experiencing?

* * *

### As I was setting up a new site, I got this message asking for my Mac administrator password. I can’t remember when I set up the other sites whether I had to allow this. And with all the PHP security information around, I thought I’d ask the question. By the way, are you providing a patch for the PHP security issue?

* * *

### System Details

- **Local Version:** Version 10.2.0+7022

- **Operating System (OS) and OS version:** 27.0.1 (26A434)

* * *

### Local Logs

Attach your Local Log

 ![CleanShot 2026-10-22 at 4.58.05 PM@2x](https://us1.discourse-cdn.com/flex019/uploads/lwpforums/original/3X/1/6/16b72c3a4855415cb9a2c6258901e6eb56553a53.jpeg)

s here ([Help Doc - Retrieving Local’s Log](https://localwp.com/help-docs/troubleshooting/retrieving-locals-log-file/))

* * *

_ **Security Reminder** _  
Local does a pretty good job of scrubbing private info from the logs and the errors it produces, however there’s always the possibility that something private can come through. Because these are public forums, always review the screenshots you are sharing to make sure there isn’t private info like passwords being displayed.

---

<div class="post-metadata">

**Author:** ![nickc](https://sea1.discourse-cdn.com/flex019/user_avatar/community.localwp.com/nickc/32/21209_2.png) [@nickc](https://community.localwp.com/u/nickc)\
**Post date:** [October 22, 2026, 7:24am UTC](https://community.localwp.com/t/php-security-patch-issue/52676/2 "2026-10-22T07:24:37Z")

</div>

Thanks for your question, @Eno1. **This password prompt is a normal part of Local.** The design of the prompt changed in macOS 27, which might be why it looks unfamiliar to you.

Local asks for your password here so it can modify your `hosts` file, which is what lets you visit the site from your browser at the `[sitename].local` domain.

> By the way, are you providing a patch for the PHP security issue?

Yes! We’re currently building new PHP versions. Local sites are not exposed to the same risk because they do not host public traffic. But we’ll offer new versions for those who want to test with them. We’ll post in this thread when they’re available:

> [@PHP vulnerabilties PHP2Shell](https://community.localwp.com/t/php-vulnerabilties-php2shell/52674/):
>
> The emergency security patches for the “PHP2Shell” vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are being rolled out for the currently supported branches of PHP. According to threat intelligence reports from platforms like [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), the specific fixed versions are: Affected Branch Minimum Fixed Version PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 When can I expect the fixed PHP versions to be available in LocalWP