最新のセキュリティ情報
2 ページ目
7月30日(木)
PHP 8.2.33 Released!
The PHP development team announces the immediate availability of PHP 8.2.33. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
7月22日(水)
7月18日(土)
WordPress 7.0.2 Release
WordPress 7.0.2 is now available. The 7.0.2 security release addresses one critical and one high severity security issue. Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions. To manually […]
7月16日(木)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-55805 Description: The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Bu…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.* CVE IDs: CVE-2026-15917 Description: Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML wi…
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-15916 Description: The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private:// . This vulnerability is mitigated by the fact t…
7月8日(水)
Laravel Cloud security defaults behind every deploy
Laravel Cloud handles WAF, runtime patching, audit logs, network isolation, and package vulnerability scans by default. See what runs in the background.
7月3日(金)
PHP 8.5.8 Released!
The PHP development team announces the immediate availability of PHP 8.5.8. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.8 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.23 Released!
The PHP development team announces the immediate availability of PHP 8.4.23. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.23 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.32 Released!
The PHP development team announces the immediate availability of PHP 8.3.32. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.32 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
7月2日(木)
PHP 8.2.32 Released!
The PHP development team announces the immediate availability of PHP 8.2.32. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.32 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
6月18日(木)
Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper validation Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55808 Description: The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.…
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side request…
Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default Vulnerability: Cache poisoning and open redirect Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55806 Description: Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55804 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execut…
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially…
5月25日(月)
Introducing Moat: A Security Review for Your GitHub Account
Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.
5月21日(木)
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Project: Drupal core Project machine name: drupal Date: 2026-May-20 Security risk: Highly critical 23 ∕ 25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:Uncommon Vulnerability: SQL injection Affected versions: >= 8.9.0 < 10.4.10 || >= 10.5.0 < 10.5.10 || >= 10.6.0 < 10.6.9 || >= 11.0.0 < 11.1.10 || >= 11.2.0 < 11.2.12 || >= 11.3.0 < 11.3.10 CVE IDs: CVE-2026-9082 Description: Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted re…
5月8日(金)
PHP 8.5.6 Released!
The PHP development team announces the immediate availability of PHP 8.5.6. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.6 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.31 Released!
The PHP development team announces the immediate availability of PHP 8.2.31. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.31 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.21 Released!
The PHP development team announces the immediate availability of PHP 8.4.21. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.21 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
5月7日(木)
PHP 8.3.31 Released!
The PHP development team announces the immediate availability of PHP 8.3.31. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.31 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
4月16日(木)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6367 Description: Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user. Solution: Install the latest version: If you use Drupal 11.3.x, update to Drup…
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6366 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or…
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6365 Description: Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: If you use Drupal 10.5.x, update to Drupal 10.5.9 . If yo…
3月14日(土)
Laravel MCP Server: Auth & Security Best Practices
Add authentication to your Laravel MCP server without writing an authorization server. Plus, security best practices.
3月11日(水)
WordPress 6.9.2 Release
WordPress 6.9.2 is now available This is a security release that features several fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 6.9.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic […]
12月19日(金)
PHP 8.1.34 Released!
The PHP development team announces the immediate availability of PHP 8.1.34. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.34 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.16 Released!
The PHP development team announces the immediate availability of PHP 8.4.16. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.16 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.30 Released!
The PHP development team announces the immediate availability of PHP 8.2.30. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.30 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.29 Released!
The PHP development team announces the immediate availability of PHP 8.3.29. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.29 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
12月18日(木)
PHP 8.5.1 Released!
The PHP development team announces the immediate availability of PHP 8.5.1. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.1 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
11月13日(木)
Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13083 Description: The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the system module. In some cases, files may be served with the HTTP header Cache-…
Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Defacement Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13082 Description: By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (suc…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13081 Description: Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution if the…
Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Denial of Service Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13080 Description: Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not.…
10月10日(金)
Fullstack Cybersecurity with Laravel. The Artisan of the Day Is Akhila Sreekumar.
Akhila Sreekumar shares her journey from India to Sweden, using Laravel to build fullstack cybersecurity apps and grow her career.
Laravel Nightwatch Achieves SOC 2 Type 1 Certification
Laravel Nightwatch achieves SOC 2 Type 1 certification, enhancing security and compliance for monitoring Laravel applications in enterprise environments.
9月21日(日)
Bringing Security to the Laravel Community. The Artisan of the Day Is Stephen Rees-Carter.
Stephen Rees-Carter, security expert and Laravel educator, shares his journey, tools, and advice for building secure, impactful apps.
9月8日(月)
PHPKonf 2025 Baku
PHPKonf 2025 will take place on October 26, 2025 in Baku, Azerbaijan, bringing together PHP developers, software engineers, and technology enthusiasts from the local and international community. This one-day conference will feature practical talks and case studies on PHP and its ecosystem, including frameworks such as Laravel and Symfony, as well as modern practices in testing, security, architecture, and performance optimization. Participants will have the opportunity to connect with experienced speakers, exchange knowledge with peers, and explore real-world solutions to everyday development…
9月5日(金)
Laravel Cloud Achieves SOC 2 Type 2 Certification, Nightwatch and Forge Next
Laravel Cloud achieves SOC 2 Type 2 certification for Security, Confidentiality, and Availability. Read how Laravel's compliance roadmap includes Nightwatch and Forge SOC 2 audits.
7月4日(金)
PHP 8.3.23 Released!
The PHP development team announces the immediate availability of PHP 8.3.23. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.23 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
7月3日(木)
PHP 8.1.33 Released!
The PHP development team announces the immediate availability of PHP 8.1.33. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.33 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.2.29 Released!
The PHP development team announces the immediate availability of PHP 8.2.29. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.29 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.4.10 Released!
The PHP development team announces the immediate availability of PHP 8.4.10. This is a security release. Version 8.4.9 was skipped because it was tagged without including security patches. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.10 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
6月20日(金)
Dropping security updates for WordPress versions 4.1 through 4.6
As of July 2025, the WordPress Security Team will no longer provide security updates for WordPress versions 4.1 through 4.6. These versions were first released nine or more years ago and over 99% of WordPress installations run a more recent version. The chances this will affect your site, or sites, is very small. If you […]
4月10日(木)
PHP Core Undergoes Security Audit – Results Now Available
A focused security audit of the PHP source code () was recently completed, commissioned by the , organized by in partnership with , and performed by . The audit targeted the most critical parts of the codebase, leading to 27 findings, 17 with security implications, including four CVEs. php/php-src Sovereign Tech Agency The PHP Foundation OSTIF Quarkslab All issues have been addressed by the PHP development team. Users are encouraged to upgrade to the latest PHP versions to benefit from these security improvements. Read the full . More details in . audit report the PHP Foundation blog post If…
3月20日(木)
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Project: Drupal core Project machine name: drupal Date: 2025-March-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >= 8.0.0 < 10.3.14 || >= 10.4.0 < 10.4.5 || >= 11.0.0 < 11.0.13 || >= 11.1.0 < 11.1.5 CVE IDs: CVE-2025-31675 Description: Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to…
3月14日(金)
PHP 8.2.28 Released!
The PHP development team announces the immediate availability of PHP 8.2.28. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.28 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.1.32 Released!
The PHP development team announces the immediate availability of PHP 8.1.32. This is a security release. All PHP 8.1 users are encouraged to upgrade to this version. For source downloads of PHP 8.1.32 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog