Fluent Rule builders got the headline, but the line in Laravel 13.36 I'd act on first is Worker::$flushStickyConnections. It ships off by default so nothing breaks for apps that rely on it. I think you should turn it on,…
Laravel 13.38 ships PreventStaleDatabaseReads, a middleware that pins a user's reads to the primary for two seconds after a write. It's handy and worth turning on. The more honest tool in the release is DB::usingWritePdo…
Everyone is talking about the model that found CVE-2026-109618 and CVE-2026-109619. The more uncomfortable number is that Cisco puts about half of internet-facing PHP on versions that no longer get security fixes. AI mad…
The php2shell exploits leave nothing in your logs. You only see what the attacker does next, which means detection depends on www-data almost never doing anything interesting. That's a design choice we can make right now…
The PHP2Shell fixes shipped on October 21, and plenty of teams still can't say which PHP binary answered their last request. Kai argues that the interpreter is your most important dependency and deserves the same treatme…
When PHP2Shell landed, the PHP project shipped emergency source patches for 7.4, 8.0 and 8.1, branches it had already retired. Be grateful, then read the gesture correctly. Your next critical CVE will be decided by how r…
The PHP project announced the critical fixes for CVE-2026-109618 and CVE-2026-109619 ahead of time, gave a date and a UTC hour, and held back the details. That was a fair deal. The trouble is that a lot of teams spent th…
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, got patches only for 8.2 through 8.5. That leaves the 7.4, 8.0 and 8.1 crowd hardening config files against a bug that fires before any of their code runs…
October 21 gave us a Laravel token guard bypass and two PHP flaws rated CVSS 9.2 on the same afternoon. Eight days on, the teams that shipped fast didn't care more than anyone else. They had a test suite they trusted and…
The fix for the session.upload_progress memory bug was scheduled for 21 October, and most teams will upgrade and forget. That's the wrong ending. A default almost nobody uses turned into a critical exposure on stock PHP …
Two CVSS 9.2 flaws in the PHP engine, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and no complete workaround. The upgrade takes minutes. What most teams actually lack is a reliable list of every PHP process answering the…
Two unauthenticated remote code execution bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, showed up on October 21, and suddenly lots of teams had no quick answer to a simple question: which binary is actual…
Two PHP flaws rated 9.2 landed on October 21, and the fixed versions are easy to name. The harder question is whether you can prove which binary is answering requests on every vhost, staging box and forgotten container r…
Laravel 13.38.0 adds a session-based two-second fallback to the write connection after a database write and introduces DB::usingWritePdo() for relationship queries that need fresh data. The release accepts floats in Rule…
An October Medium report attributes two alleged critical PHP vulnerabilities, CVE-2026–109618 and CVE-2026–109619, to research involving Wiz and OpenAI’s GPT-5.6 Sol. It claims a 9.2 severity score, unauthenticated remot…
OpenAI has released a checker for Codex that tests whether a website publicly reveals a PHP version within the affected range. The phpcheck-url skill works from a URL, and phpcheck-server validates the local installation…
PHP’s emergency fixes on October 21, 2026 address CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution flaws rated CVSS 9.2. A community Wazuh deployment uses process sampling and file-integrity…
Kevin Lopez has raised two semantic issues in the draft PHP Pattern Matching RFC. Array patterns should distinguish a missing key from an explicit null and use array_key_exists(). Integer patterns and numeric ranges shou…
OpenAI, Google and other AI labs are using frontier models to locate PHP vulnerabilities, build exploits and check proposed fixes. The current crisis involves structural flaws that may enable unauthenticated remote code …
A Reddit post is framed as a response from within the PHP security team to circulating PHP2Shell claims. The available excerpt names no disputed statements and no affected PHP versions. It cites no CVE and no exploit evi…
OffSeq’s research examines PHP2Shell activity during the first 48 hours recorded by its Mirage honeypot fleet. The company says PHP2Shell had leaked before a patch was available. Its first exploit-shaped request arrived …
Updated setup-php builds now include fixes for CVE-2026-109618 and CVE-2026-109619 across PHP 5.3 through 8.7. The builds target Linux, macOS and Windows, and include security backports for end-of-life PHP branches used …
Petecooper has apologized on Hacker News for an earlier post about the expected PHP RCE disclosures CVE-2026-109618 and CVE-2026-109619. The author says they did not know an embargo existed because two contacts had passe…
New details on PHP2Shell identify CVE-2026-109618 and CVE-2026-109619 as critical PHP runtime flaws rated 9.2 by the PHP security team. The scheduled fixes cover 8.2 through 8.5 only. PHP 8.1 and older remain unsupported…
Two 9.2-rated engine bugs, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, hit servers whose application code was spotless. Kai argues the fix is cultural: application teams should pin and ship the interpreter the way th…
This Medium article adds no new vulnerability details beyond PHP’s October 21 advisory and the fixed releases already covered. Its practical guidance is to verify the PHP runtime serving a site, including PHP-FPM or Apac…
Composer 2.11.0-RC1 is available for testing ahead of the stable release. The pre-release removes the temporary source-fallback option and adds a configurable cooldown for new packages. It hardens TLS and bin proxy gener…
An article by Elias Taylor dated October 21, 2026 argues that the newly discussed PHP vulnerability has no reliable exploit against an unmodified PHP installation. Taylor says thousands of GitHub PoCs depend on extra ser…
