PHP/Laravel Security and MANY New Packages
Laravel Weekly
Your weekly dose of Laravel insights & resources
What a week, huh? Yesterday many of us had to refresh the dashboards waiting for PHP patches, try to upgrade automatically/manually, and forget about "regular daily life". So, portion of this week's newsletter will be the links related to that security issue.
But also, over the week a huge amount of new Laravel package releases happened, so make sure to check them out. Enjoy this issue!
From my YouTube Channel
From Laravel Community
PHP critical vulnerability response updates | Laravel Blog
On 10/21 two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application o...
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
PHP: Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
PSA: Lock down your MCP OAuth registrations : r/laravel
Last week, I posted about a vulnerability I reported not being addressed in a timely manner. I received the response this morning and they've...
Laravel Emails Going to Spam?
Fix Laravel emails going to spam with SMTP configuration examples, SPF and DKIM checks, DMARC alignment, DNS commands and a practical troubleshooting checklist.
Quittio: EN 16931 e-invoices for Laravel (ZUGFeRD/Factur-X, XRechnung, Peppol), open source : r/laravel
Hi r/laravel, E-invoicing is becoming mandatory across Europe: Belgium since January 2026, France from September 2026, Germany from 2027, and...
We open-sourced 50+ Laravel packages
50+ free, MIT-licensed Laravel packages: 400,000+ lines of tested code your AI agent no longer has to write. 12,000+ tests and full docs.
Most of Your API Has Already Been Designed
Error formats, retries, lost updates, webhook signing: the IETF has already answered them. api-toolbox brings those answers to Laravel, one RFC per feature.
Krixx1337/filament-licensekit
Your software, your rules. Self-hosted licensing for Laravel & Filament.
pablozagni/nightguardian
Self-hosted, open-source error & health monitoring (Laravel + Filament). Groups errors into issues, alerts on Telegram/e-mail, friendly error page with reference codes
asignua/filament-chat
Team chat inside Filament 5 panels: direct messages and groups, @mentions, replies, editing, reactions, read receipts, unread counters, a slide-over you can pin beside any page, and record cards — drop a link to a panel record into the chat. Real-time via Reverb, Pusher or Ably, or polling. 10 languages
Real road distance and travel time in Laravel with OSRM
"Nearest store" features usually sort by straight-line distance: the haversine formula, a few lines...
fydellys/inertia-static
Inertia Static brings SSG/ISR to Laravel + Inertia.js without depending on a specific provider. Your pages are rendered at the origin, cached at the edge of any CDN, revalidated by time or on demand, and navigated as a normal Inertia SPA. No session ever reaches the cache
lauroguedes/laravel-astro-landing
Keep an Astro landing page in your Laravel repository: scaffold it from a template or theme with one artisan command, run it with composer run dev, and deploy it on its own with GitHub Actions
sajjadhossainshohag/laravel-lang-cache
Make your Laravel translations load faster by caching them, like config and routes. Up to 1,600 times faster with OPcache. Works with Laravel 10–13
James-2050/laravel-uk-kyb-edge
Sub-20ms UK Companies House address sanitization, geocoding, and director KYB for Laravel
kwasii1/laravel-sql-parser
A fast SQL parser and transpiler for Laravel, written in pure PHP. Parse SQL into a syntax tree, then optimize it or translate it to another dialect, like MySQL to SQL Server or Postgres to SQLite. A port of sqlglot with 30+ dialects
janczakb/filament-flex-fields
The ultimate form components kit and custom fields builder for Filament v5. Over 79 premium inputs, layout cards, and dynamic JSON storage—designed with exceptional UI aesthetics and performance-first asset loading
Validating EU VAT Numbers, IBANs and Italian Tax Codes in Laravel
How to validate IBANs, EU VAT numbers and the Italian codice fiscale in Laravel: the check-digit algorithms, VIES, and the GR/EL prefix trap.
Tweets from the Community
Hristijan Manasijev on X: "I found a CRITICAL auth bypass in Laravel (9.2/10) On MySQL/MariaDB, Laravel's token API guard let an unauthenticated attacker log in as an existing victim user."
On MySQL/MariaDB, Laravel's token API guard let an unauthenticated attacker log in as an existing victim user. Patched in 12.68.0 & 13.29.0. Thanks to the @laravel team & @taylorotwell for the fast fix
Node.js on X: " Node.js security updates are now available!"
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues. Review the details and update your systems to stay secure. https://t.co/W4kfzx5lxz #NodeJS #Security
Leandro on X: "Filament tip: rate limit any Action in one line"
1 attempt per minute per IP. Over the limit, the action doesn't run and the user sees a notification
Introducing Flock PHP 1.0 beta!
A 100% free and open source local development environment for Laravel and PHP, native on macOS and Windows. No paid tier, every feature included.
That's it for this week, see you in the next newsletter issue!
Povilas Korop
Unit A3 Gateway Twr, 32 Western Gateway, London