Latest security news
Page 13
Fri, July 22
Customer Balances for Spark Stripe
In the latest release of Spark Stripe, we're happy to introduce support for Customer Balances. With this new addition, customers will be able to view their current balance and top up their balance: !...
Thu, July 21
PHP 8.2.0 Beta 1 available for testing
The PHP team is pleased to announce the first beta release of PHP 8.2.0, Beta 1. This continues the PHP 8.2 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.2.0 Beta 1 please visit the . download page Please carefully test this version and report any issues found in the . bug reporting system Please DO NOT use this version in production, it is an early test version. Because of a bug found in early testing of this release, this version is NOT usable with ZTS builds. For more information on the new features and other changes, you can read th…
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2022-015
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Multiple vulnerabilities Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25276 Description: The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. This advisory is not cove…
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Arbitrary PHP code execution Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25277 Description: Updated 2022-07-20 19:45 UTC to indicate that this only affects Apache web servers. Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012 ) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-…
Drupal core - Moderately critical - Access Bypass - SA-CORE-2022-013
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access Bypass Affected versions: >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25278 Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes…
Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012
Project: Drupal core Project machine name: drupal Date: 2022-July-20 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information Disclosure Affected versions: >=7.0 <7.91 || >= 8.0.0 <9.3.19 || >= 9.4.0 <9.4.3 CVE IDs: CVE-2022-25275 Description: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file syst…
Tue, July 19
Laravel: New "about" Command
Following on from the recently introduced fresh new look for Artisan, we took some time to identify new Artisan commands to further improve the Laravel experience. Another newly introduced command is "about". This command displays information about your application's environment.
Laravel: New "model:show" Command
Following on from the recently introduced fresh new look for Artisan, we took some time to identify new Artisan commands to further improve the Laravel experience. One of the newly introduced commands is "model:show". This command dumps out the model and table highlights for the given model.
Laravel: Refreshing Artisan
On today's release of Laravel v9.21.0, we’re bringing you a fresh new look for Artisan: a brand new console output on the vast majority of Laravel commands that deliveries a better console experience, and displays more information in commands such as "migrate" or "queue:work".
Fri, July 15
Laravel Pint v1.0 Released
After a few beta releases, today we've finally reached the first stable release of Pint. And, starting with next week's release of Laravel, Pint will be included on every new Laravel application as a `dev` dependency.
Thu, July 14
Longhorn PHP 2022 - CFP Open
Howdy, y'all! 🤠 is returning for its 4th year in Austin, TX! We are a community-run conference for PHP developers in Texas and beyond. We are excited to bring PHP developers from all backgrounds together again for 3 days of fun and education. Longhorn PHP We are currently . Talk ideas will be accepted until August 11, 2022. accepting submissions for 50 minute talks and 3 hour tutorials While the , we also have our Blind Bird tickets available for sale. CFP is open Register now! Follow us on , or signup for emails at to get notified with important conference updates. Twitter longhornphp.com
Fri, July 8
PHP 8.1.8 Released!
The PHP development team announces the immediate availability of PHP 8.1.8. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.8 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, July 7
PHP 8.2.0 Alpha 3 available for testing
The PHP team is pleased to announce the third testing release of PHP 8.2.0, Alpha 3. This continues the PHP 8.2 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.2.0 Alpha 3 please visit the . download page Please carefully test this version and report any issues found in the . bug reporting system Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the…
PHP 8.0.21 Released!
The PHP development team announces the immediate availability of PHP 8.0.21. This is a bug fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.21 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Wed, July 6
International PHP Conference Munich 2022
The is the world's first PHP conference and stands since more than a decade for top-notch pragmatic expertise in PHP and web technologies. At the IPC, internationally renowned experts from the PHP industry meet up with PHP users and developers from large and small companies. Here is the place where concepts emerge and ideas are born - the IPC signifies knowledge transfer at highest level. International PHP Conference All delegates of the International PHP Conference have, in addition to PHP program, free access to the entire range of the taking place at the same time. International JavaScript…
Sat, July 2
SymfonyWorld Online 2022 Winter Edition
is the global Symfony conference in English for PHP developers from all around the World. Two days of online workshops (December 6-7) followed by two days (December 8-9) full of online talks on PHP, Symfony and its ecosystem. SymfonyWorld Online 2022 Winter Edition Check out all the conference details
Fri, July 1
SymfonyCon Disneyland Paris 2022
is the global Symfony conference in English for PHP developers from all around the World. Two days of workshops (November 15-16) followed by two days (November 17-18) full of talks on PHP, Symfony and its ecosystem. SymfonyCon Disneyland Paris 2022 Each ticket includes an invitation for two people to the exclusive party (20:00 - 23:30, November 17) where conference attendees will enjoy Walt Disney Studios Park open exclusively for them. Enjoy this special moment with your family or friends. We've also negotiated a discounted rate in one of the Disney's hotels. Check out all the conference det…
Sat, June 25
Super-charging Laravel Forge Deployments with Environment Variables
Aside from provisioning servers and creating sites, Laravel Forge does so much more, including deploying code to your sites.
Fri, June 24
PHP 8.2.0 Alpha 2 available for testing
The PHP team is pleased to announce the second testing release of PHP 8.2.0, Alpha 2. This continues the PHP 8.2 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.2.0 Alpha 2 please visit the . download page Please carefully test this version and report any issues found in the . bug reporting system Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in th…
Thu, June 23
Vapor: Understanding Concurrency
Every application running on Vapor is powered by AWS Lambda, which allows us to run code without needing to think about servers. One of the biggest benefits of this type of infrastructure is that it a...
Mon, June 13
Vapor: GitHub Integration + Scaffolding
Today, we are excited to announce that you may create Vapor projects by simply connecting your GitHub account and letting Vapor do the rest! Need more details? Here's what we mean. Starting today, Vapor can create a new GitHub repository, deploy the new application to Vapor, and configure GitHub actions to deploy to Vapor each time you push fresh code to your new application.
Sat, June 11
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011
Project: Drupal core Project machine name: drupal Date: 2022-June-10 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.21 || >= 9.3.0 <9.3.16 CVE IDs: CVE-2022-31042 CVE-2022-31043 Description: Updated 22:00 UTC 2022-06-10: Added steps to update without drupal/core-recommended . Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories: Failure to strip the Cookie header on change…
Laravel Forge: Real-Time Deployment Output
Today we’re pleased to announce that you can now see the real-time output from your deployments as they happen. You can see the live deployment output in the Deployments panel of any site that is actively deploying.
Fri, June 10
PHP 8.0.20 Released!
The PHP development team announces the immediate availability of PHP 8.0.20. This is a security release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.20 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.2.0 Alpha 1 available for testing
The PHP team is pleased to announce the first testing release of PHP 8.2.0, Alpha 1. This starts the PHP 8.2 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.2.0 Alpha 1 please visit the . download page Please carefully test this version and report any issues found in the . bug reporting system Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the re…
Thu, June 9
PHP 8.1.7 Released!
The PHP development team announces the immediate availability of PHP 8.1.7. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.7 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 7.4.30 Released!
The PHP development team announces the immediate availability of PHP 7.4.30. This is a security release. All PHP 7.4 users are encouraged to upgrade to this version. For source downloads of PHP 7.4.30 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, June 2
Retrying Payments in Spark Stripe
Today we're excited to launch a new feature for Spark Stripe: manual payment retries! When a customer's recurring payment fails, Stripe will typically re-attempt the payment a few days later. However...
Thu, May 26
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-010
Project: Drupal core Project machine name: drupal Date: 2022-May-25 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.20 || >= 9.3.0 <9.3.14 CVE IDs: CVE-2022-29248 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside…
Fri, May 13
Vapor: Unlimited Assets & Asset Uploads 10x Faster
We are thrilled to announce that applications may now have unlimited public assets and the 400 public assets hard limit has been removed. In addition, we have made multiple performance enhancements to our deployment pipeline that uploads assets to S3. So, asset uploads are now up to 10x faster.
PHP 8.1.6 Released!
The PHP development team announces the immediate availability of PHP 8.1.6. This is a bug fix release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.6 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, May 12
PHP 8.0.19 Released!
The PHP development team announces the immediate availability of PHP 8.0.19. This is a bug fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.19 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Tue, May 10
Forge: Ubuntu 22.04 Support
We're excited to announce that Laravel Forge now supports Ubuntu 22.04 (Jammy) - the latest Ubuntu LTS release from Canonical!
Fri, May 6
Vapor: Aurora Serverless v2 Is Now Available
This new version adds support for MySQL 8.0, and has a faster, more granular, less disruptive scaling than Aurora Serverless v1.
Thu, May 5
CakeFest 2022: The Official CakePHP Conference
- our annual conference dedicated to CakePHP will be virtual this year allowing bakers from all over the world to attend, from home! Two full days of CakePHP knowledge. Day 1 is workshops and day 2 will be a full day of talks on CakePHP related technologies. These events are an ideal way to learn as both beginners and advanced users. CakeFest 2022 Date: September 29 & 30 Time: 12:00pm UTC Check out details at: CakeFest.org
Mon, April 25
Dutch PHP Conference 2022 - Schedule
We are thrilled to present the schedule of the Dutch PHP Conference 2022. This conference is a Online Edition, full of high-level technical sessions. Last year we welcomed visitors from a whopping 55+ countries! We hope to host another great and globally online edition of DPC this year. FREE ! You can register now We look forward to virtually meeting you on June 24! Mark those calendars!
Thu, April 21
Manage Composer Credentials with Laravel Forge
Forge now makes it even easier and quicker to manage your server's Composer package configurations and deployments with the introduction of the new "Packages" panel.
Drupal core - Moderately critical - Access bypass - SA-CORE-2022-009
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25274 Description: Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content.…
Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-008
Project: Drupal core Project machine name: drupal Date: 2022-April-20 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper input validation Affected versions: >= 8.0.0 <9.2.18 || >= 9.3.0 <9.3.12 CVE IDs: CVE-2022-25273 Description: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter cr…
Tue, April 19
Laravel Forge Command Palette
Today we're happy to ship a wonderful new feature to Laravel Forge: the Forge Command Palette! We love making Forge the fastest, simplest, and most enjoyable way to manage your Laravel servers across...
Fri, April 15
PHP 8.0.18 Released!
The PHP development team announces the immediate availability of PHP 8.0.18. This is a bug fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.18 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.1.5 Released!
The PHP development team announces the immediate availability of PHP 8.1.5. This is a bug fix release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.5 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, April 14
PHP 7.4.29 Released!
The PHP development team announces the immediate availability of PHP 7.4.29. This is a security release for Windows users. This is primarily a release for Windows users due to necessarily upgrades to the OpenSSL and zlib dependencies in which security issues have been found. All PHP 7.4 on Windows users are encouraged to upgrade to this version. For source downloads of PHP 7.4.29 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Tue, April 12
Spark 2.0 Now Available!
We're happy to announce that Spark 2.0 is now available! Spark Stripe 2.0 includes support for [Cashier Stripe](https://github.com/laravel/cashier-stripe) v13, offering the latest compatibility enhan...
Fri, April 8
Laravel Nova 4.0 Now Available!
This week we are thrilled to launch Nova 4.0 - the largest update to Laravel Nova since its initial release in 2018. David, Mior, and the rest of the Nova team have been hard at work to make this the...
Tue, March 29
Vapor: Applications May Now Have Up to 10 GB Of Temporary Storage
AWS recently announced that AWS Lambda now supports up to 10 GB ephemeral storage. In other words, this means that your Vapor environment functions may now hold up to 10 GB of information in the `/tmp` directory.
Tue, March 22
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-006
Project: Drupal core Project machine name: drupal Date: 2022-March-21 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.16 || >= 9.3.0 <9.3.9 CVE IDs: CVE-2022-24775 Description: Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which may affect some Drupal sites. We are issuing this security advisory outside our regular Drupal security release window schedule since Guzzle has alr…
Fri, March 18
PHP 8.1.4 Released!
The PHP development team announces the immediate availability of PHP 8.1.4. This is a bug fix release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.4 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Thu, March 17
PHP 8.0.17 Released!
The PHP development team announces the immediate availability of PHP 8.0.17. This is a bug fix release. All PHP 8.0 users are encouraged to upgrade to this version. For source downloads of PHP 8.0.17 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005
Project: Drupal core Project machine name: drupal Date: 2022-March-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >= 8.0.0 <9.2.15 || >= 9.3.0 <9.3.8 CVE IDs: CVE-2022-24728 CVE-2022-24729 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (e…