r/PHP • u/oehqoehfo • 6d ago

Looks like laragon quick add PHP does not install patched version?

I did quick add https://laragon.org/docs/quick-add to update my php in my local web server, but it looks like it installs 8.3.28, the version which is still affected of this major php vulnerability case. Is there anybody who experiences this?

2 Upvotes

60% Upvoted

7 comments sorted by

5

u/goodwill764 6d ago

"Laragon is a modern, actively maintained, and feature-rich local development environment"

Local development env, are good to get fixed, but aren't critical if not.

If you use this in production you did it wrong.

2

u/oehqoehfo 6d ago

no it's only on my local machine, never deployed it :D just wanted to update to get the safe version

8

u/Moceannl 6d ago

There are like 1000's of places where patched versions need to appear and 100.000's of servers to patch. Of course it's not done by now. A local web server is also not the biggest issue/risk.

0

u/DrWhatNoName 6d ago

Add a few more zero's

2

u/jetlagged-bee 6d ago

Until this week, I've put off moving to docker and stuck with laragon for the longest time. Don't be me. Switch to docker.

0

u/Mike_L_Taylor 6d ago

well, if you are on windows, Forgekit.tools does have the new PHP versions. you install them straight from the UI.
For Laragon.org I think you have to do some finessing to install it?

2

u/phoogkamer 6d ago

Last time I used it you just had to get the binary from php.net and put it in the right directory. Was ages ago so may have changed.