PlanPHP & Laravel
Laravel 13 is the line to be on
Laravel 12 stopped receiving bug fixes on August 13, 2026. Laravel 13 supports PHP 8.3 to 8.5, with security fixes until March 17, 2028.
Web Programming: Verified news for full-stack developers. Every claim links to its primary source.
Top stories
More updates
WatchPHP & Laravel
PHP 8.6 brings partial function application
RC1 lands on September 24 and general availability on November 19. Leave ? or ... in place of arguments and you get a closure back.
Patch nowPHP & Laravel
Composer 2.10.3 fixes two more CVEs, including a Perforce command injection
Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.
This week's triage
Issue #1 ·
One thing to do this week
Search your repositories for pull_request_target and for next/og on the Node.js runtime. Those two searches map to two of the most expensive problems of the summer.
Patch now
Security fixes to apply now.
5stories
Plan
Upgrades and deadlines to schedule.
7stories
Watch
Releases and changes coming up.
10stories
Sources
Every claim this week links to one.
26primary sources
This week · Issue #1 ·
The Full-Stack Upgrade Map: What to Patch, Plan and Watch (September 2026)
- Next.js 16.3.6 fixes a critical RCE in next/og (Sept 22)
- npm 12 no longer runs dependency install scripts by default
- TypeScript 7 is native and 8 to 12x faster, but not a drop-in upgrade
- PHP 8.6 RC1 lands this week, with the final release on Nov 19
Patch nowPHP & Laravel
Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS
· By Karlen Trimino
PlanJS & TypeScript
npm's brutal year: the TanStack compromise and the ChainDrop worm
· By Karlen Trimino
