ACTION REQUIRED: NativePHP Mobile - Security Advisory #001 - October 2026

NativePHPOct 27, 2026

Apologies for the intrusion, but this is an important one!

🚨 THIS REQUIRES ACTION ON YOUR PART 🚨

Besides last week's PHP CVEs, over the weekend we were alerted to a chain of Medium-to-High-level vulnerabilities in NativePHP Mobile itself.

These represent a real risk to your apps and your users. Mostly for those of you building with the web view (not SuperNative) or using the <webview> SuperNative/EDGE component.

While we believe exploiting these vulnerabilities is not trivial, the impact if exploited could be considerable, including exfiltration of the app's SQLite database and APP_KEY.

Therefore, we want to take every precaution and make sure everyone is aware so you can take the necessary action.

Please read the full blog post for all of the details, but for convenience, here are your key actions:

Update nativephp/mobile to 4.6.1 (or 3.3.11 if you're on the 3.x line).
If you use the nativephp/mobile-file plugin, update it to 1.0.3. If you're on 4.x, remove it instead: core already provides File.Move and File.Copy.
Regenerate your native project and rebuild: php artisan native:install --force
Ship the new build to your users. This will require new app store releases. Builds already on people's devices stay vulnerable until they're updated.

If you have any questions or concerns, just reply to this email and I'll be happy to help.

If you find bugs or broken behaviour because of the patches, please alert us to this and we will get them resolved immediately. And if you become aware of other vulnerabilities, please use responsible disclosure to alert us to them (i.e. don't post about it publicly).

Thank you for your time.

Simon