Secure login and authentication in PHP
This isn't a matter of security, but mashing things onto a single line

else { return $user; }


is considered poor form in most style guidelines.



public static function isUser() {
    if (!self::getUser()) { return false; } else { return true; }
}


reads a bit more naturally if you don't use an inverted condition:

public static function isUser() {
    if (self::getUser()) { return true; } else { return false; }
}


And then it's easy to see that you can simplify it to just

public static function isUser() {
    return (bool)(self::getUser());
}




Similarly,

else if ($user-&gt;role === 'admin') { return true; }
else { return false; }


can be simplified to

return $user-&gt;role === 'admin';




$user = User::where('username', $username)-&gt;orWhere('email', $username)-&gt;first();


is a bit strange.  Users can log in via either email or username?  Are they both unique?  It will simplify your life (and theirs) a lot if there's only one unique identifier for each user.



You're using password_hash and password_verify, which is good.  You may want to consider setting the cost parameter to password_hash to something other than the default to get something that makes sense for your hardware.