PHP in XAMPP for version 8.1.x is outdated

[murugappan]

Hi,

The current version of PHP 8.1 is 8.1.15. Why is XAMPP still using PHP 8.1.12? How do i upgrade the PHP version in XAMPP?

[Altrea]

Hi,

Why is XAMPP still using PHP 8.1.12?

Because it was the current version at last release date in Nov 2022.

How do i upgrade the PHP version in XAMPP?

Changing the minor version is as easy as downloading the correct PHP binary zip, extract it and copy the php.ini

[alibaba]

Hi,

same here, it happened really a lot since the last release in Nov 2022.

What is the "correct" PHP binary zip for PHP 8.1.x and Windows?
https://windows.php.net/download#php-8.1
- VS16 x64 Thread Safe
- VS16 x64 Non Thread Safe

Thx

[Altrea]

it happened really a lot since the last release in Nov 2022.

What are you missing personally that makes it so important for you to update?

[alibaba]

Patch Management. As example:

https://nvd.nist.gov/vuln/detail/CVE-2023-27522
https://nvd.nist.gov/vuln/detail/CVE-2023-25690
https://nvd.nist.gov/vuln/detail/CVE-2022-37436
https://nvd.nist.gov/vuln/detail/CVE-2022-36760
https://nvd.nist.gov/vuln/detail/CVE-2006-20001
Curl 7.88.1 - https://curl.se/changes.html
nghttp2 v1.52.0 - https://github.com/nghttp2/nghttp2/releases
OpenSSL Updates


Of course, it depends on how you use the software and especially which modules, protocols, ... But there are probably only in rare cases good reasons not to install patches for such a long time. Regardless of whether it is a test environment or not.

[Altrea]

XAMPP is a local test and development environment for beginners who do not have the knowledge to set up the components itself.
Just in very rare cases a vulnerability can do any harm to a local XAMPP installation and its system.
If you care about security assessment results you are most likely in a professional environment where XAMPP is not the right tool for.

[alibaba]

I have a different perspective here. In my eyes, it doesn't matter if it's a test environment. Unless the test environment itself is in some sort of sandbox, which is probably rarely if ever the case.

But it is your decision. We can be glad that the possibilities exist at all thanks to XAMPP.

[Altrea]

It is not my decision. I am just a community support board administrator, not in relationship with any XAMPP development.
But XAMPP does not provide any sort of updater. That alone should tell us that XAMPP is not designed to be always up to date.
But all XAMPP components are open source. Even the build scripts are provided on github.
So if you want to, you can build your own XAMPP with the components and versions you want to.