Critical PHP RCE Fixes, Laravel Auth Bypass - №638

This week in Laravel

Week 638

PHP Security Releases Fix Two Critical RCE Vulnerabilities

The PHP team just released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that allow unauthenticated remote code execution. Every PHP install that serves web requests is affected, so update your servers today. The post has the update steps for Laravel Cloud, Forge, Vapor, and Envoyer.

Read more

Test Your Auth Flow Without Production

@workos/emulate runs the WorkOS API locally for development and CI.

Seed users, organizations, RBAC roles, and SSO connections, then test full AuthKit login flows, signed webhooks, token refresh, and error handling. Responses and event shapes come from the WorkOS OpenAPI spec, so your tests exercise the same surface you use in production.

Run WorkOS locally

Volker Dusch on the PHP RCE Vulnerabilities and Disclosure

Volker Dusch of the PHP Foundation explains how the two critical PHP RCE vulnerabilities were found, fixed, and disclosed, plus the leak and broken embargo.

Read more

Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68

A critical auth bypass in Laravel's token API guard let attackers log in as other users on MySQL and MariaDB. Update to 12.68.0 or 13.29.0.

Read more

Run Large PlanetScale Queries in Laravel With DB::olap()

Laravel's new DB::olap() method runs PlanetScale and Vitess queries in OLAP mode to get past the 100,000 row limit, then switches the connection back.

Read more

Screenshot: Capture Images and PDFs with PHP and Laravel

Screenshot captures HTML, Blade views, and web pages as PNG, JPEG, or PDF files with Chrome, then saves them locally or to Laravel filesystem disks.

Read more

Skuul: Open-Source School Management Built on Laravel

Skuul 3.0 is an open-source school management app on Laravel 13 and Livewire 4, with per-campus roles, gradebooks, a family portal, and fee tracking.

Read more

‍

Laravel Jobs

‍

The official Laravel job board connecting the best jobs with top talent.

‍

View all

‍

Now hiring

Post a job on LaraJobs and it'll be featured here next week.

Prevent Stale Database Reads in Laravel 13.38

Laravel 13.38 adds PreventStaleDatabaseReads middleware and DB::usingWritePdo() so users see their own writes when you read from database replicas.

Read more

Reset Sticky Database Connections Between Laravel Queue Jobs

Laravel 13.36 adds Worker::$flushStickyConnections so queue jobs go back to your read replicas after an earlier job writes to the database.

Read more

Laravel Read Replicas: Prevent Stale Reads After a Write

Laravel's PreventStaleDatabaseReads middleware keeps a user's reads on the write database after they save, so read replica lag doesn't show them old data.

Read more

Decide with Jev: Turn AI Answers into Decisions with PHP Rules

Jev answers questions about a draft, while a small PHP class turns those answers into one label. When the answers are unclear, the draft goes to a person.

Read more

Laravel News PO Box 196 Cramerton NC, 28032
Send us a postcard! You are receiving this because you joined the Laravel News weekly digest. If you know someone who would enjoy this newsletter please consider sharing it.