FeaturedPatch nowJS & TypeScript
Next.js 16.3.6 fixes a critical remote code execution flaw in next/og
The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected.
Karlen Trimino ·
Blog
Every story Web Programming has published, newest first, each with its primary sources.
Patch nowPHP & Laravel
PHP fixes an SQL injection in the pg_* functions
CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases.
Patch nowJS & TypeScript
Node.js July security releases fixed 11 CVEs, three rated High
The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High.
PlanJS & TypeScript
npm 12 stops running dependency install scripts by default
npm v12 became the default on July 8. Dependency lifecycle scripts, Git dependencies and remote URL dependencies are now opt-in.
PlanJS & TypeScript
TypeScript 7 is native and 8 to 12 times faster, but not a drop-in
TypeScript 7.0, the native port written in Go, shipped July 8. It has no stable programmatic API yet, and its new defaults change your tsconfig.
PlanPHP & Laravel
Laravel 13 is the line to be on
Laravel 12 stopped receiving bug fixes on August 13, 2026. Laravel 13 supports PHP 8.3 to 8.5, with security fixes until March 17, 2028.
WatchPHP & Laravel
PHP 8.6 brings partial function application
RC1 lands on September 24 and general availability on November 19. Leave ? or ... in place of arguments and you get a closure back.
Patch nowPHP & Laravel
Composer 2.10.3 fixes two more CVEs, including a Perforce command injection
Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.
Patch nowPHP & Laravel
Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS
Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.
PlanJS & TypeScript
npm's brutal year: the TanStack compromise and the ChainDrop worm
An attacker chained a pull_request_target workflow into 84 malicious TanStack versions, and a worm planted persistence in editor and AI tool config.