Claude Code for PHP on a Mac: setup, Laravel and PHP 8.6

The php.net advisory is short and serious. Two bugs (CVE-2026-109618 and CVE-2026-109619) can let an attacker run code on a PHP server with a single request, no login needed. Every PHP setup that serves web pages is affected, including PHP-FPM, Apache with mod_php and FrankenPHP. The PHP team says there are no complete workarounds. Updating is the fix.

Your Mac is probably not a public server, but the PHP on it is the one you test with, and the habit carries over to production. Check what you have:

php -v

If you installed PHP with Homebrew, updating takes a minute. As of today the php formula is 8.5.12, and the older branches have their own formulae:

brew update
brew upgrade php        # or php@8.4, php@8.3, php@8.2

Then restart anything that runs PHP for you, like brew services restart php for PHP-FPM, or php artisan serve if it's running. Paste your version below to check it.

Then do the same on your servers, your Docker images and your CI, because that's where these bugs matter most. PHP 8.2 also reaches end of life on 31 December 2026, so if production is still on 8.2, this is a good week to plan the move.

Claude Code runs in Terminal. Anthropic's quickstart has the install line:

curl -fsSL https://claude.ai/install.sh | bash

There's also a Homebrew cask, brew install --cask claude-code. That one doesn't update itself, so run brew upgrade claude-code now and then. You need a Claude plan or an API account to sign in.

Then go to your project and start it:

cd ~/Sites/my-shop
claude

The first time, type /init. Claude looks through the project and writes a CLAUDE.md file with what it found: the framework, the folders, the commands. Read it, because it's a guess, and fix anything that's wrong.

Good first questions for a PHP codebase you don't know well:

1. "What does this app do, and where does a request go from public/index.php?"
2. "Which PHP version does composer.json ask for, and which packages are old?"
3. "Find the slowest-looking database queries and explain why."

When you want it to change code, start in plan mode (press Shift+Tab until it says plan). It shows you what it would change before it touches a file.

The most useful line in a PHP project's CLAUDE.md is the PHP version you run in production. Your Mac might have 8.5 while the server runs 8.3. Without that line, Claude happily writes code that works on your Mac and breaks on deploy.

Composer can help with the same problem. Set the production version in composer.json, so composer update picks packages that work there:

"config": {
    "platform": { "php": "8.3.36" }
}

The second most useful part is the commands. If Claude knows how to run your tests, your static analysis and your formatter, it runs them after a change and fixes what fails before it tells you it's done. Pick your stack below and copy the result into a CLAUDE.md in your project's root folder.

# Notes for Claude

## Stack
- PHP 8.4 in production. Don't use features from newer PHP versions.
- Laravel, with Composer for dependencies.
- Never edit `vendor/`. Ask me before running `composer update`.

## Commands
- Tests: `php artisan test`
- Static analysis: `vendor/bin/phpstan analyse`
- Format: `vendor/bin/pint`
- After every change, run `php artisan test`, `vendor/bin/phpstan analyse`, `vendor/bin/pint` and fix what they report before you say you're done.

## Rules
- Start new PHP files with `declare(strict_types=1);`.
- Add types to every new parameter, property and return value.
- Laravel app. Use Artisan to make files (`php artisan make:model`, `make:controller`, `make:migration`).
- Validation goes in Form Request classes, not in controllers.
- Never edit a migration that has already run. Add a new one.
- Use Eloquent relationships instead of raw joins unless I ask.
- Plan first for changes that touch more than 3 files, and show me the plan.

Keep it short and true. Claude follows what's written there, so a stale rule ("we use PHPUnit" when you moved to Pest) causes more trouble than a missing one. When Claude does something you don't like twice, that's a new line for the file.

Laravel Boost is Laravel's own package for AI coding tools. It does two things. It writes Laravel guidelines into your CLAUDE.md (inside its own block, so your notes stay), and it runs an MCP server, a small program Claude Code can ask questions. Install it in the project:

composer require laravel/boost --dev
php artisan boost:install

Pick Claude Code when it asks. Boost usually sets up Claude Code by itself. If it doesn't, the docs give this command:

claude mcp add -s local -t stdio laravel-boost php artisan boost:mcp

Now Claude can read your PHP and Laravel versions, your installed packages and models, the database schema, the last error in your logs, and search docs that match the package versions you have. That last one matters: it stops Claude from using an API from a Laravel version you're not on.

Two tips from the docs. The generated files (.mcp.json, boost.json and the guideline files) are rebuilt on every boost:install and boost:update, so you can leave them out of git. The .ai/rules folder is different: it holds rules for your own app, like "money is stored as integer cents", and it belongs in git so your whole team gets them.

Boost has a Database Query tool. Point it at your local database, never at production.

A CLAUDE.md asks Claude to run your checks. A hook makes sure it happens. It's a command Claude Code runs by itself after every edit. Save this as .claude/hooks/php-lint.sh and make it runnable with chmod +x:

#!/bin/bash
# Lint each PHP file Claude edits. Exit 2 tells Claude.
FILE=$(jq -r '.tool_input.file_path')
case "$FILE" in *.php) ;; *) exit 0 ;; esac
if ! OUT=$(php -l "$FILE" 2>&1); then
  echo "$OUT" >&2
  exit 2
fi
if [ -x "$CLAUDE_PROJECT_DIR/vendor/bin/pint" ]; then
  "$CLAUDE_PROJECT_DIR/vendor/bin/pint" "$FILE" >/dev/null 2>&1
fi
exit 0

Then add it to .claude/settings.json:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/php-lint.sh" }
        ]
      }
    ]
  }
}

The script reads the edited file's path from what Claude Code sends it, with jq (brew install jq if you don't have it). php -l only checks syntax, so it's fast enough to run on every edit. Keep the slow things, the full test suite and PHPStan, as commands in your CLAUDE.md.

The hook can't undo an edit, because it runs after it. What exit code 2 does is put the error in front of Claude, which then fixes it. Commit the folder and everyone on the project gets the same check.

PHP 8.6 brings things people have wanted for a while: default values for readonly properties, partial function application, a clamp() function and a new Time\Duration class. It also deprecates a list of old habits. Deprecations don't break anything yet, but they fill your logs and they become errors in a later version.

From the 8.6 UPGRADING notes, the ones most likely to be in an older codebase:

Two behaviour changes are worth a test too: preg_grep() now returns false on a regex error, and sessions now default to strict mode, HttpOnly cookies and SameSite=Lax.

Paste a file into the checker below. It shows what it finds by line, and gives you a prompt to paste into Claude Code with the list.

For a whole project, ask Claude Code to do the same across every file, one kind of fix per commit, and to run the tests after each one. Don't run the release candidates in production. Test with them in CI or Docker, and switch on the day 8.6.0 is out.

When Claude Code finishes a change, check it the way a user would, then record that check for the pull request. A short clip of the new form, the fixed page or the tests going green helps whoever reviews it, and that includes you a week later.

macOS can do this for free. Press Shift-Command-5, pick Record Selected Portion, and draw around the browser window. That's enough for most pull requests.

I use Clacky, the Mac app I make, for the same job. Its recorder can record a single window, so notifications and the rest of your desktop stay out, and the editor cuts the pauses for you. It also plays cozy keyboard and click sounds while you type and click. Keyboard sounds listen for key down/up only; Clacky never records, stores or sends which keys are typed, and it respects Secure Input. It costs $4.99 a month or $19.99 once, with a 3-day free trial.

If you leave Claude Code running on a long task, my guide on getting a notification when Claude Code finishes means you don't have to keep checking Terminal.