Releases and security notices.

Vhostly 1.3.0: a safer setup, import and export, and Vhostly Pro

Earlier versions allowed passwordless sudo apachectl, which any program running as you could use to gain root. 1.3.0 removes it.

Vhostly 1.2 and earlier gave your account ownership of /etc/hosts and allowed sudo apachectl without a password. Because Homebrew's apachectl sits in a folder you own, that rule could be used by any program running as you to become root.

1.3.0 asks for your password once when it opens and removes both: Apache keeps running as you, /etc/hosts goes back to root, and a small root-owned helper that only accepts .test and .localhost names writes Vhostly's block. The helper is printed in full on vhostly.app/security.

Also new: import and export your sites, and Vhostly Pro licenses with up to three Macs per key.

Download Vhostly 1.3.0 and drag it over the old one in Applications
Open it and enter your password at the one-time setup prompt

Download 1.3.0

Vhostly 1.2.1 released

Closing the window keeps Vhostly running in the background instead of asking whether to quit.

Your sites keep being served while the window is closed. Click the Dock icon to bring it back, and press Cmd+Q to quit.

Download the new version and drag it over the old one in Applications.

Download 1.2.1

PHP advisory: turn off session upload progress and keep PHP up to date

Setting session.upload_progress.enabled=0 helps, but it is not enough on its own: keep PHP on the latest release.

This closes an unlikely remote code execution path, CVE-2026-115560. It needs an unusual setup: an application configured with the php_binary or php_serialize session handler that switches to php with ini_set() before session_start(), with upload progress still enabled.

Applications that never change the serialize handler at runtime can leave the feature on. If you applied this setting after the 21 October advisory, keep it in place. The full advisory comes with the next PHP release.

This setting only closes one path. It does not replace the 21 October security update, so run the latest PHP release for your version and install the next one when it ships.

session.upload_progress.enabled = 0
brew update && brew upgrade php

php.net

Vhostly 1.2.0 released

Proxy sites can now run a start command when they are switched on.

Give a proxy site the command that starts its dev server, and Vhostly runs it whenever you turn the site on.

Release notes

Critical PHP vulnerabilities: update now

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow unauthenticated remote code execution.

CVE-2026-109618 and CVE-2026-109619 affect every PHP installation serving web requests. The PHP team considers the risk highest for Apache with mod_php, which is the setup Vhostly manages, and has demonstrated an exploit that runs before any application code.

Updating is the only complete fix. Check your version in the PHP panel, upgrade the Homebrew formula you use, then restart Apache so it loads the new module. PHP 8.1 and older no longer receive updates from the PHP project, and PHP 8.2 reaches end of life on 31 December 2026.

php -v
brew update && brew upgrade php
brew upgrade php@8.4

php.net

Vhostly 1.1.2 released

Adds the About pane and recovers public tunnels left without an owner.

A public URL tunnel that lost track of its process is picked up again instead of being stranded. The window also opens larger.

Release notes

Vhostly 1.1.1 released

Changing a site's port now updates its HTTPS block too.

The :443 virtual host is rewritten along with the :80 one, so an HTTPS site keeps pointing at the right port. Adding and editing a site now happens in a dialog.

Release notes