Does PHP2Shell affect my Mac? How to check if PHP is installed

MacUpdated

PHP2Shell affects your Mac only if PHP is installed on it, and the PHP manual says PHP hasn't been included with macOS since macOS 12 Monterey. Most people's Macs will only have it if they, or a tool they installed, added it. You can check in Terminal in under a minute.

Quick answer

The PHP project's 21 October 2026 advisory covers two critical flaws, CVE-2026-109618 and CVE-2026-109619, in PHP installations serving web requests. The PHP manual says macOS has not included PHP since macOS 12 Monterey. Open Terminal and type php -v. If it shows a version, update it to a fixed release the way you installed it.

Does macOS come with PHP?

Not on recent versions, according to the PHP manual. It says PHP was bundled with macOS in versions 10 and 11, but is not included in versions since macOS 12 Monterey, and that installing it on recent versions needs packages from third-party sources or compiling it from source.

Apple's own release notes that we checked don't mention PHP. The macOS Catalina 10.15 notes say only that scripting language runtimes such as Python, Ruby and Perl were included for compatibility, and that future versions wouldn't include them by default. So the PHP manual is the source here, and checking your own Mac settles it.

How do I check if PHP is installed on my Mac?

Use Terminal, the way the PHP manual describes. Its command line documentation says that typing php -v in a shell tells you the version of PHP and whether it is the CLI or CGI version. If a version number comes back, PHP is installed and you can compare it with the fixed versions below.

  1. In the Finder, open the Applications folder, then Utilities, and double-click Terminal. Apple describes this route in its Terminal guide.
  2. Type php -v and press Return.
  3. Read the first line. It starts with "PHP" and a version number, for example PHP 8.3.36.
  4. Compare it with the fixed releases in the PHP advisory: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older in the same series needs updating. PHP 8.1 and older get no updates from the PHP project at all.

Who on a Mac might have PHP installed?

Mostly people who build or test websites. The PHP manual's macOS pages describe two routes: installing packages from third parties, or compiling PHP from source. It names Homebrew as an easy way (brew install php), and lists MacPorts and Fink as alternatives.

You might also have PHP if:

  • you build or test PHP websites on your Mac and installed PHP to do it
  • you installed a local server tool that bundles its own PHP. The NCSC asks organisations to watch for updates from vendors whose products bundle PHP, and the same applies to an app on your Mac
  • you've used PHP's built-in web server (php -S). The PHP manual says it is designed to aid application development, isn't intended for production, and should not be used on a public network

If none of these sounds like you, php -v will confirm it either way.

Is the PHP on my Mac actually at risk?

It depends on how you use it. The PHP advisory says the people at risk are all PHP installations serving web requests, and it names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where it says there is a demonstrated exploit that an unauthenticated request can trigger before any application code runs.

The advisory doesn't say anything about PHP used only from the command line, so we can't tell you that use is safe. The NCSC's alert says organisations using any version of PHP are affected and should update to the latest version. Updating is the simple answer for a Mac too.

On exploitation, as of 23 October 2026, the US agency CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication".

How do I update PHP on a Mac?

Update it the same way you installed it. The PHP advisory says to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and that source downloads are on php.net's downloads page. If you installed PHP with a package manager, update it through that package manager. If it came inside a local server app, update the app, or check its maker's site for a release with the fixed PHP.

Settings changes are not a fix. The advisory says the measures it lists reduce exposure to specific attack paths but do not make an installation safe.

If you're on PHP 8.1 or older, the advisory says the PHP project no longer updates those versions, and suggests upgrading to a supported version. The PHP security team did publish minimal source backports for 7.4, 8.0 and 8.1, which are for people who build PHP from source.

After updating, run php -v again and check the version number has changed.

Does browsing the web on a Mac run PHP?

No. The PHP manual explains that PHP code is executed on the server, which then sends the resulting HTML to your browser. Your browser receives the result and never sees the PHP code. So reading a website built with PHP doesn't run PHP on your Mac, and PHP2Shell is a problem for the site's server rather than your laptop.

A website that has been hacked can still be a risk to its visitors in other ways, such as fake login pages or harmful downloads. Our guide to whether visiting a hacked website can hack you covers that side.

Where Failshot fits

Failshot is second layer device security for your Mac. Your password is the first layer, and Failshot is the layer after it, for when someone unlocks your Mac with that password while you're away from it.

With Failshot on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for Mac, on macOS 14 or later. Free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Does a macOS update fix PHP?

The PHP manual says macOS hasn't included PHP since macOS 12 Monterey, so on those versions any PHP was installed separately and has to be updated the way it was installed. Keep macOS updated anyway, but don't assume it updates PHP from a package manager or a local server app.

My Mac runs macOS Big Sur or older. Does it have PHP?

It may. The PHP manual says PHP was bundled with macOS in versions 10 and 11. Run php -v in Terminal to see whether a version comes back, and compare it with the fixed releases in the steps above.

Is there a further PHP issue after 21 October?

Yes, a separate and much less likely one, CVE-2026-115560, published by the PHP project on 23 October. Our PHP2Shell explainer covers it.

Sources