PHP Security, New Packages and NativePHP
Laravel Weekly
Your weekly dose of Laravel insights & resources
Another active week in Laravel community with a lot to watch and read. So, without further ado, let's dive in!
From our sponsor
Skyline adds the missing alerting layer to Horizon
With per-queue configuration, get the alerts that matter, without the noise. Queue falling behind, worker keeps restarting because of memory limit, and a dozen more - with different severity and routing options. And those jobs not dispatched because a lock was left by a worker crash? We got that covered too.
From my YouTube Channel
From Laravel Community
PHP2Shell: you patched, but were you hit?
Patching PHP2Shell (CVE-2026-109618 and CVE-2026-109619) closes the hole, but it does not tell you whether someone got in before you patched. Here is a read-only bash script that checks your PHP builds and looks for the few traces an exploitation attempt leaves behind.
Our first security advisories, and this week's PHP CVEs - Blog - NativePHP
Important security updates inside, please read!
What I learned building a Laravel 13 app with laravel/mcp, Passport, Saloon and PHPArkitect (open source) : r/laravel
I've been building Traceway, a route planner that plans running and cycling loops and sends them to a watch/bikecomputer, solo on Laravel 13 and...
Session Replay for Laravel is out of beta! v1.0 release: Self-hosted rrweb recordings, built-in viewer, and Log Viewer integration (Free & MIT) : r/laravel
Hey r/laravel! A while back I posted here asking if anyone would find a self-hosted session replay package useful while it was still in beta....
Quittio/quittio
E-invoicing for Laravel: ZUGFeRD/Factur-X, XRechnung, UBL and Peppol BIS based on EN 16931
Laravel PHP - daily news digest | Witaj!
A daily digest of the Laravel and PHP world: new framework releases, ecosystem packages, RFCs and security advisories - concise, straight to your inbox, for free.
pushery/visual-feedback-for-laravel
Visual feedback for Laravel and Livewire with client-side screenshot capture, browser and page context, privacy-safe redaction, accessible UI, built-in abuse protection with no external service, and flexible delivery via mail, database, or signed webhooks
savgoran/laravel-scheduled-sequence
Persistent, state-aware scheduling sequences with irregular timing for Laravel applications
qiick-io/externa-core
Data-first headless CMS with dynamic schema, relations and file management
mykholy/laravel-leakproof
Detect sensitive data leaks in Laravel JSON API responses with PHPUnit assertions, CLI scanning, and optional middleware
roundly-consulting/lifecycle-for-laravel
Status lifecycles for Eloquent models: guarded named transitions, limits and quotas, expiry and scheduled transitions, rollbacks and an append-only history
jakub-lipinski/consent-for-laravel
Cookie consent for Laravel with built-in tracking integrations, Google Consent Mode v2, Livewire support, and customizable banners
mertbag96/laravel-domain-migrator
Analyze a Laravel MVC app, suggest domains and a shared kernel, and move it toward a modular, domain-oriented structure
Tweets from the Community
FrankenPHP 1.13.4 is out.
It fixes 7 vulnerabilities, mostly in worker mode: - A single unauthenticated request could crash the whole server (1.13.2 and 1.13.3) - Per-request environment variables and upstream response headers leaked into later requests -…
Laravel Cloud Console has shipped.
Easier to show than tell, so here’s a video. Interactive shell for every Laravel Cloud application. Run any command. Full audit trail with replay capability for every session.
m@ttias on X: "This latest PHP release introduces a new setting called memory_hard_limit_percent"
It changes what "memory_limit" does: it's now a soft limit. A second, higher limit sits above it. An explainer is in this post, since memory_limit is core to PHP!
That's it for this week, see you in the next newsletter issue!
Povilas Korop
Unit A3 Gateway Twr, 32 Western Gateway, London