FeaturedPatch nowPHP & Laravel
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 security advisories
On September 24 PHP shipped security releases for every supported branch, including a fix for credentials leaking on HTTP redirects.
Karlen Trimino ·
Blog
Every story Web Programming has published, newest first, each with its primary sources.
Patch nowJS & TypeScript
Next.js 16.3.8 fixes seven vulnerabilities, with a critical fix still to come
On September 30 Next.js released 16.3.8 and 15.5.27. The high-severity fix is an SSRF in Image Optimization, and a critical fix was postponed.
Patch nowJS & TypeScript
Two compromised GitHub Actions came back online with their malicious tags
actions-cool/issues-helper and actions-cool/maintain-one-comment became available again on September 16 with their malicious tags still in place.
Patch nowPHP & Laravel
Laravel AI SDK and Laravel MCP 1.0.1 fix an SSRF and an open redirect
Laravel AI SDK 1.0.1 fixes a moderate SSRF, and Laravel MCP 1.0.1 and 0.9.6 fix a low-severity open redirect in the OAuth flow.
PlanPHP & Laravel
PHP 8.6 reaches release candidate with stricter session defaults
There was no RC1: the first release candidate is RC2, shipped September 24. The feature list is frozen, and three session defaults change.
Patch nowJS & TypeScript
Compromised MemTensor packages on npm and PyPI steal developer credentials
On September 23 compromised releases of a MemTensor npm plugin and of MemoryOS on PyPI bundled a Go binary that searches $HOME for credentials.
PlanJS & TypeScript
GitHub Actions runners no longer have Node 20
Since September 23, JavaScript actions run on Node 24 and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out no longer works.
PlanPHP & Laravel
Laravel AI SDK 1.0 adds tool approvals, classification and streaming protocols
Laravel AI SDK 1.0 shipped September 23 with new features and breaking changes to conversation storage, token names and streaming.
WatchAI Tools
Claude Sonnet 5.5 and GPT-6.1 Sol both launch at $2/$10 per million tokens
Anthropic and OpenAI released new models a day apart at the same price, and both are already in GitHub Copilot.
PlanAI Tools
Copilot Business and Enterprise apply a default feature policy from October 22
From October 22, Copilot applies a default policy to every eligible feature, code review policy and MCP server setting you haven't configured.