Patch nowPHP & Laravel
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 security advisories
On September 24 PHP shipped security releases for every supported branch, including a fix for credentials leaking on HTTP redirects.
Patch now
Security fixes to apply now. 10 stories.
Patch nowJS & TypeScript
Next.js 16.3.8 fixes seven vulnerabilities, with a critical fix still to come
On September 30 Next.js released 16.3.8 and 15.5.27. The high-severity fix is an SSRF in Image Optimization, and a critical fix was postponed.
Patch nowJS & TypeScript
Two compromised GitHub Actions came back online with their malicious tags
actions-cool/issues-helper and actions-cool/maintain-one-comment became available again on September 16 with their malicious tags still in place.
Patch nowPHP & Laravel
Laravel AI SDK and Laravel MCP 1.0.1 fix an SSRF and an open redirect
Laravel AI SDK 1.0.1 fixes a moderate SSRF, and Laravel MCP 1.0.1 and 0.9.6 fix a low-severity open redirect in the OAuth flow.
Patch nowJS & TypeScript
Compromised MemTensor packages on npm and PyPI steal developer credentials
On September 23 compromised releases of a MemTensor npm plugin and of MemoryOS on PyPI bundled a Go binary that searches $HOME for credentials.
Patch nowJS & TypeScript
Next.js 16.3.6 fixes a critical remote code execution flaw in next/og
The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected.
Patch nowPHP & Laravel
PHP fixes an SQL injection in the pg_* functions
CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases.
Patch nowJS & TypeScript
Node.js July security releases fixed 11 CVEs, three rated High
The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High.
Patch nowPHP & Laravel
Composer 2.10.3 fixes two more CVEs, including a Perforce command injection
Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.
Patch nowPHP & Laravel
Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS
Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.