Build APM on Windows: Apache + PHP 8.4 + MariaDB Series Index

Yesterday (21 October 2026), PHP released patches for two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also known as php2shell, with a CVSS score of 9.2. The patched versions are 8.4.27, 8.3.36, 8.2.35 and 8.5.12. I covered the details in PHP Has Two Critical RCE Vulnerabilities: Update Today. I checked the Windows machine I use for coding and found that its XAMPP installation still had PHP 8.2.12, Apache 2.4.58 and MariaDB 10.4, all from 2023.

The problem is not that XAMPP is bad, but that bundles like this always lag behind upstream. I cannot wait for a new bundle, because the day a vulnerability is disclosed is the day I want to update my own machine. I built my own web stack on Windows entirely from upstream source code, named it APM (Apache, PHP, MariaDB), and designed it so that when a security release comes out, I can change the version number in a single file called versions.json and rebuild that same day.

This series is based on an actual build on 22 October 2026, running Windows 11 (i5-12500H, RAM 32 GB). Every result in the series was measured. Wherever I did not save the output, I explain what to check instead of inventing the exact text.

What Is APM, and What Do You End Up With?

APM is not a new program. It is a set of PowerShell scripts and configuration files (collectively called the build kit) that downloads each component's source, verifies its hash and compiles it with MSVC. The result is a C:\APM folder that looks like XAMPP, but every component is the latest version I have chosen, with a source I can verify.

The PHP build has 51 modules, matching the set I use in production except for posix, sysvmsg, sysvsem and sysvshm, which are unavailable on Windows. This includes three PECL extensions: redis, igbinary and imagick. PHP runs through mod_fcgid, not mod_php. For Apache's OpenSSL, I chose the 3.5 LTS branch, which is supported until April 2030.

A single request follows this path, and the deployed folders sit under C:\APM as shown in the diagram.

I chose default ports 8080, 8443 and 3307 to avoid conflicts with XAMPP, which is still running on the same machine (XAMPP uses 80, 443 and 3306). If you have stopped using XAMPP, you can switch to the standard ports during deployment, which I explain in Part 7.

How Much Time and Disk Space Does It Take?

These numbers matter more than you might think, because the first build takes several hours. If the machine goes to sleep or the disk fills up halfway through, that time is wasted. Set the power plan to prevent sleep before starting, and check the free disk space first.

Download and Verify the Build Kit

The kit is a zip file of about 47 KB (47 files) containing all the scripts, versions.json and configuration files. Follow these steps in order.

Open a regular pwsh session (no admin required) and work through each step.

1. Download the file using the commands in the next block (or open the URL in a browser and save it to the Downloads folder).
2. Check the file size. It must be 48142 bytes.
3. Calculate the sha256 and compare it with the value I published. The result must be True.
4. Do not extract the file yet. Extraction to `C:\apm-build` is covered in Part 1, after all the tools are installed.

curl.exe -L -o "$env:USERPROFILE\Downloads\apm-build-kit.zip" https://linuxthai.org/files/apm-build-kit.zip
(Get-Item "$env:USERPROFILE\Downloads\apm-build-kit.zip").Length
Get-FileHash "$env:USERPROFILE\Downloads\apm-build-kit.zip" -Algorithm SHA256

You should see a file size of 48142 and a hash table with the Hash value in uppercase as shown below.

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          24BA604D8EE0F355F14C61C948C616FBDB9F97A0A75FC4955BCC64CD939D6206       C:\Users\<you>\Downloads\apm-build-kit.zip

If you do not want to compare it by eye, let PowerShell compare it (PowerShell string comparisons are case-insensitive). The result must be True.

(Get-FileHash "$env:USERPROFILE\Downloads\apm-build-kit.zip" -Algorithm SHA256).Hash -eq '24BA604D8EE0F355F14C61C948C616FBDB9F97A0A75FC4955BCC64CD939D6206'

Kit update, 22 Oct 2026 (afternoon)

The upstream build scripts were fixed again after I wrote the series, so I rebuilt the kit from the latest scripts. It is now 48142 bytes with 47 files. New files: LICENSE (installed as C:\APM\LICENSE.txt), scripts\trust-ca.ps1, scripts\new-cert.ps1, scripts\firewall-lan.ps1 and scripts\set-path.ps1. versions.json now has "apm_version": "1.0.0" as its first key. There are 14 fixes in total, and each one is covered in the part listed.

Three-Command Shortcut for Machines with the Tools Ready

If Visual Studio Build Tools, Git, CMake, Ninja and PowerShell 7 are all installed (Part 1 walks through this), and the kit is extracted to C:\apm-build, the whole system takes just three commands. Run every command in a regular pwsh session, without admin privileges.

1. Build the entire system into the `stage\` folder. The first run takes about 2.5 hours.
2. Deploy to `C:\APM`, creating the config, cert and data directory without starting anything yet.
3. Start MariaDB and Apache, then test with curl.

cd C:\apm-build
.\build.cmd

During the build, the scripts periodically print status messages in this format. If you see [ERR], stop and read the logs in build\logs\ before continuing.

==== fetch ====
...
==== fetch done in 0.0 min ====
==== vcpkg ====

To stop after a given step, use .\build.cmd -To <step>. The steps are fetch vcpkg apache mariadb imagemagick php (resume later with -From).

After the build finishes, proceed with deployment. The last line should be [OK] APM deployed to C:\APM (http :8080, https :8443, db :3307) - not started.

.\deploy.cmd

Then start MariaDB, followed by Apache. These are the results I measured on 22 October 2026 (Part 7 explains each line and how to stop them).

Start-Process C:\APM\mariadb\bin\mariadbd.exe -ArgumentList '--defaults-file=C:\APM\data\mysql\my.ini'
C:\APM\mariadb\bin\mariadb.exe -uroot --port=3307 --protocol=tcp -e "select version(), @@collation_server, @@have_ssl, @@bind_address"
Start-Process C:\APM\apache\bin\httpd.exe
curl.exe -s -o NUL -w "%{http_code} %{content_type}`n" http://127.0.0.1:8080/
curl.exe -sk -o NUL -w "%{http_code}`n" https://localhost:8443/

version()            @@collation_server    @@have_ssl   @@bind_address
11.8.9-MariaDB-log   utf8mb4_unicode_ci    YES          127.0.0.1
200 text/html; charset=UTF-8
200

The server's home page at http://127.0.0.1:8080/ shows PHP version 8.4.27, the OPcache JIT status, the MariaDB version and a list of loaded extensions. Append ?info=1 to view phpinfo().

Contents of the Full Series

Every part follows the same format: numbered steps, the terminal and folder to run commands in, expected output, ways to verify success, an "If It Fails Here" section and a checklist at the end.

Part 7 includes a section that directly addresses the original purpose of this series: what to do when PHP releases a new version. The shortest answer is to change PHP's version, url and sha256 in versions.json, run 00-fetch.ps1 -Only php and 30-php.ps1 -Step all, then deploy again. There is no need to rebuild Apache or MariaDB.

Who Should Not Do This?

Building from source gives me faster updates and a known source for every binary, but costs time, disk space and the responsibility of maintaining it myself. Here is a direct comparison.

My view is that if your websites run mainly on Linux, a Windows stack with versions matching production is enough for testing. There is no need to chase every patch release within a day. But if the Windows machine exposes ports to the internet, keeping it updated cannot wait.

This series does not yet cover installation as a Windows Service or vhost management through a control tool called apmctl; those will be covered in a separate article later. I have not included its commands here because it is not finished. For now, start and stop the components manually as described in Part 7.

If you get stuck anywhere in any part, let me know what error you encountered and which command you were running. I will come back and add fixes later.