PHP & Laravel

PHP, Laravel and Composer: security fixes, releases and support dates.

FeaturedPatch nowPHP & Laravel

PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 security advisories

On September 24 PHP shipped security releases for every supported branch, including a fix for credentials leaking on HTTP redirects.

Karlen Trimino · Oct 2, 2026

Patch nowPHP & Laravel

Laravel AI SDK 1.0.1 fixes a moderate SSRF, and Laravel MCP 1.0.1 and 0.9.6 fix a low-severity open redirect in the OAuth flow.

Oct 2, 2026

PlanPHP & Laravel

There was no RC1: the first release candidate is RC2, shipped September 24. The feature list is frozen, and three session defaults change.

Oct 2, 2026

PlanPHP & Laravel

Laravel AI SDK 1.0 shipped September 23 with new features and breaking changes to conversation storage, token names and streaming.

Oct 2, 2026

WatchPHP & Laravel

Queue improvements in Laravel 13.34.0, plus preview environments and request metrics in Laravel Cloud.

Oct 2, 2026

Patch nowPHP & Laravel

CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases.

Sep 23, 2026

PlanPHP & Laravel

Laravel 12 stopped receiving bug fixes on August 13, 2026. Laravel 13 supports PHP 8.3 to 8.5, with security fixes until March 17, 2028.

Sep 23, 2026

WatchPHP & Laravel

RC1 lands on September 24 and general availability on November 19. Leave ? or ... in place of arguments and you get a closure back.

Sep 23, 2026

Patch nowPHP & Laravel

Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.

Sep 23, 2026

Patch nowPHP & Laravel

Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.

Sep 23, 2026