PHP & Laravel
PHP, Laravel and Composer: security fixes, releases and support dates.
PHP fixes an SQL injection in the pg_* functions
CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases.
Laravel 13 is the line to be on
Laravel 12 stopped receiving bug fixes on August 13, 2026. Laravel 13 supports PHP 8.3 to 8.5, with security fixes until March 17, 2028.
PHP 8.6 brings partial function application
RC1 lands on September 24 and general availability on November 19. Leave ? or ... in place of arguments and you get a closure back.
Composer 2.10.3 fixes two more CVEs, including a Perforce command injection
Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.
Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS
Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.
PHP support calendar: target 8.4 or 8.5 today
PHP 8.2's security fixes end on December 31, 2026, the same day PHP 8.4's active support ends.
Laracon US: an image manipulation API, Laravel LSP and artisan doctor
The July 29 announcements worth your time, from Blade formatting in Pint to human approval of tool calls in the AI SDK.