FeaturedPatch nowPHP & Laravel
PHP fixes an SQL injection in the pg_* functions
CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases.
Karlen Trimino ·
PlanPHP & Laravel
Laravel 13 is the line to be on
Laravel 12 stopped receiving bug fixes on August 13, 2026. Laravel 13 supports PHP 8.3 to 8.5, with security fixes until March 17, 2028.
WatchPHP & Laravel
PHP 8.6 brings partial function application
RC1 lands on September 24 and general availability on November 19. Leave ? or ... in place of arguments and you get a closure back.
Patch nowPHP & Laravel
Composer 2.10.3 fixes two more CVEs, including a Perforce command injection
Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.
Patch nowPHP & Laravel
Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS
Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.
PlanPHP & Laravel
PHP support calendar: target 8.4 or 8.5 today
PHP 8.2's security fixes end on December 31, 2026, the same day PHP 8.4's active support ends.
WatchPHP & Laravel
Laracon US: an image manipulation API, Laravel LSP and artisan doctor
The July 29 announcements worth your time, from Blade formatting in Pint to human approval of tool calls in the AI SDK.