Web Programming
Español

Web Programming: Verified news for full-stack developers. Every claim links to its primary source.

Top stories

Patch nowPHP & Laravel

PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 security advisories

On September 24 PHP shipped security releases for every supported branch, including a fix for credentials leaking on HTTP redirects.

Karlen Trimino ·

Patch nowJS & TypeScript

Next.js 16.3.8 fixes seven vulnerabilities, with a critical fix still to come

On September 30 Next.js released 16.3.8 and 15.5.27. The high-severity fix is an SSRF in Image Optimization, and a critical fix was postponed.

Karlen Trimino ·

Patch nowJS & TypeScript

Two compromised GitHub Actions came back online with their malicious tags

actions-cool/issues-helper and actions-cool/maintain-one-comment became available again on September 16 with their malicious tags still in place.

Karlen Trimino ·

Patch nowPHP & Laravel

Laravel AI SDK and Laravel MCP 1.0.1 fix an SSRF and an open redirect

Laravel AI SDK 1.0.1 fixes a moderate SSRF, and Laravel MCP 1.0.1 and 0.9.6 fix a low-severity open redirect in the OAuth flow.

Karlen Trimino ·

PlanPHP & Laravel

PHP 8.6 reaches release candidate with stricter session defaults

There was no RC1: the first release candidate is RC2, shipped September 24. The feature list is frozen, and three session defaults change.

Karlen Trimino ·

More updates

Go to the blog

This week's triage

Issue #2 ·

One thing to do this week

Search your workflows for actions-cool/issues-helper and actions-cool/maintain-one-comment, then pin every third-party action to a full commit SHA.

Read issue #2

Patch now

Security fixes to apply now.

5stories

Plan

Upgrades and deadlines to schedule.

5stories

Watch

Releases and changes coming up.

8stories

Sources

Every claim this week links to one.

31primary sources

This week · Issue #2 ·

PHP Patches 11 CVEs, Next.js Ships 16.3.8 and PHP 8.6 Reaches RC: What to Patch, Plan and Watch (October 2, 2026)

  • PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 CVEs (Sept 24)
  • Next.js 16.3.8 fixes 7 vulnerabilities, with a critical fix still to come
  • Two compromised GitHub Actions came back online with their malicious tags
  • Claude Sonnet 5.5 and GPT-6.1 Sol both launch at $2/$10 per million tokens
Read issue #2Leer en español

The latest

Browse by topic

Explore more stories

Get the next issue

Follow Web Programming on LinkedIn and each weekly issue lands in your feed.

Follow on LinkedInRSS feed