最新のセキュリティ情報
2 ページ目
9月17日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
Project: Drupal core Project machine name: drupal Date: 2026-September-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor th…
9月11日(金)
A better way to build MCP servers with Laravel
Every MCP tool loads on every request. Laravel MCP 1.0 fixes that with searchable tool catalogs: the same payload for 10 or 100 tools.
Dutch PHP Conference 2027
🚀 Dutch PHP Conference 2027 is coming! 🚀 We’re thrilled to announce that the 21st edition of the Dutch PHP Conference will take place from March 16 to March 19, 2027 in Amsterdam! 🗓️ 🎤 Call for Papers is now OPEN! 🎤 Got insights, skills, or experience to share? Submit your talk ideas before the deadline on December 18th! We’re looking for both technical and non-technical sessions that will inspire and engage our community. 🎟️ Early Bird Tickets Available Now! 🎟️ This year, we're excited to split our conference into an action-packed 2-day format! A standard DPC conference day ticket now…
PHP 8.6.0 Beta 3 is available for testing
The PHP team is pleased to announce the third beta release of PHP 8.6.0, Beta 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Beta 3 please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS…
9月10日(木)
Why I think we should write our own PR descriptions
Agents can write your PR descriptions, but they shouldn't. Here's why writing them yourself makes you a better engineer and a better teammate.
PHPBenelux Conference 2027, Antwerp Belgium
PHPBenelux is back! After 11 successful editions, the leading PHP conference in Belgium, the Netherlands and Luxembourg is back for a one-day event on Saturday January 23 2027. Join us in Antwerp for a new chapter of technical excellence, community, and connection. , and visit for more information about the conference. Buy your tickets here https://conference.phpbenelux.eu
PHPBenelux Conference 2027, Antwerp Belgium
The is back and now it's your turn to take the stage! Whether you're a developer, architect, engineering lead, DevOps engineer, or open-source contributor, we'd love to hear your story. Join a long tradition of knowledge sharing, inspire fellow developers, and help shape the next chapter of the PHP ecosystem. Share your unique perspective, PHPBenelux Conference submit your proposal today!
9月4日(金)
Laravel August product updates
Here's everything that shipped in August.
9月3日(木)
Semantic memory or just Markdown?
Why Laravel Boost project rules use a generated Markdown index after we deleted semantic search.
9月2日(水)
PHP Conference Ehime 2026
PHP Conference Ehime will be held for the first time on October 3, 2026 (JST), at Ehime University Johoku Campus in Matsuyama City, Ehime Prefecture, Japan.🍊 The theme of the conference is "技術愛とコミュニティ愛と愛媛愛と": love for technology, love for the community, and love for Ehime. Join us in this castle and hot-spring town of Shikoku, and connect with PHP developers from all over Japan. Tickets are , and further information is available on the and on . on sale now event page X(Twitter)
9月1日(火)
Extracting AI rules from an existing codebase
How Laravel Boost uses an agent skill to find existing project conventions and record the useful ones as scoped rules.
8月31日(月)
Forum PHP 2026 - Paris (France)
Join the biggest PHP event organized by the French PHP user group, organized for the third time in Disneyland Paris, at the Hotel New York - The Art of Marvel! During two days, on October 8th and 9th, enjoy the company of our friendly audience, share your knowledge with +700 attendees, meet the companies who use PHP every day, in a environment that will bring even more magic to the language. Date: October 8 & 9 Check out more details at Afup.org
8月28日(金)
PHP 8.5.10 Released!
The PHP development team announces the immediate availability of PHP 8.5.10. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.10 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
8月27日(木)
PHP 8.4.25 Released!
The PHP development team announces the immediate availability of PHP 8.4.25. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.25 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.6.0 Beta 2 available for testing
The PHP team is pleased to announce a new beta release of PHP 8.6.0, Beta 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Beta 2 please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS UPGR…
8月26日(水)
Laravel Private Cloud is now HIPAA compliant
Laravel Private Cloud is now HIPAA compliant. See what the certification covers, what a BAA gets you, and how to secure PHI in your Laravel app.
8月25日(火)
Last Call for the State of PHP Survey
The is still open, but not for much longer. It asks how PHP is working for you: what you build with, what is painful, and what you think PHP should focus on next. It takes around 15 minutes. State of PHP survey The survey is run by in partnership with by JetBrains. The PHP Foundation PhpStorm The aggregated results will be published later this year as the State of PHP 2026 report. The anonymized raw dataset will be released along with it, so anyone in the community can check the numbers or run their own analysis. More responses mean a better picture of what matters to PHP users. If you have n…
8月19日(水)
Object storage migrations with Laravel's read-through filesystem
Migrate from S3 to R2 without downtime using Laravel 13's read-through filesystem driver. New writes land on the destination, legacy reads promote on access.
8月18日(火)
LonghornPHP 2026
Longhorn PHP is back for 2026! The schedule is now live, and tickets are on sale! The conference will be held in Austin, Texas, and will start with an optional tutorial day on Thursday, October 15, followed by a full day of talks, keynotes, open spaces and more, on Friday, October 16. , with Early Bird pricing available through end of day September 16th. Our full schedule is available now
8月17日(月)
We built laracon.us/photos. We’re not developers.
We had hundreds of Laracon photos and no good way to share them. So two field marketers built laracon.us/photos with Claude, Laravel, and Laravel Cloud.
8月13日(木)
PHP 8.6.0 Beta 1 is available for testing
The PHP team is pleased to announce the first beta release of PHP 8.6.0, Beta 1. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Beta 1 please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS…
8月12日(水)
WordPress 7.0.4 Release
WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.4 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]
8月7日(金)
WordPress 7.0.3 release
WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]
Managed Queues: Autoscaling Queue Workers on Laravel Cloud
Laravel Cloud’s managed queues autoscale workers on queue pressure, surface failed jobs in a built-in dashboard, and scale to zero when idle.
7月30日(木)
PHP 8.4.24 Released!
The PHP development team announces the immediate availability of PHP 8.4.24. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.24 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.33 Released!
The PHP development team announces the immediate availability of PHP 8.3.33. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.6.0 Alpha 3 available for testing
The PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Alpha 3 please visit the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the relea…
PHP 8.5.9 Released!
The PHP development team announces the immediate availability of PHP 8.5.9. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.9 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.33 Released!
The PHP development team announces the immediate availability of PHP 8.2.33. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.33 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
7月29日(水)
Everything we announced at Laracon US 2026
Every Laravel framework and Cloud announcement from Laracon US 2026, including Laravel LSP, Inertia DevTools, managed queues, and scale-to-zero.
Deploy Next.js and Nuxt apps on Laravel Cloud
Deploy your Next.js or Nuxt frontend alongside your Laravel app on Laravel Cloud: one platform, one deploy workflow, one bill.
7月25日(土)
AI coding agents pass tests. Can they write idiomatic Laravel?
AI coding agents can now pass every Laravel Boost eval. Next up: measuring idiomatic Laravel and correct code per token.
7月22日(水)
7月18日(土)
WordPress 7.0.2 Release
WordPress 7.0.2 is now available. The 7.0.2 security release addresses one critical and one high severity security issue. Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions. To manually […]
7月16日(木)
PHP 8.6.0 Alpha 2 available for testing
The PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Alpha 2 please visit the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the relea…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-55805 Description: The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability. This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Bu…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.* CVE IDs: CVE-2026-15917 Description: Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML wi…
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Project: Drupal core Project machine name: drupal Date: 2026-July-15 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.* CVE IDs: CVE-2026-15916 Description: The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private:// . This vulnerability is mitigated by the fact t…
7月14日(火)
International PHP Conference Munich 2026
is the world's first PHP conference and has stood for more than two decades for top-notch pragmatic expertise in PHP and web technologies. At the IPC, internationally renowned experts from the PHP industry meet up with PHP users and developers from large and small companies. Here is the place where concepts emerge and ideas are born – the IPC signifies knowledge transfer at the highest level. The International PHP Conference Basic facts: Date: October 26 – 30, 2026 Location: Holiday Inn Munich City Centre, Munich or Online Highlights: 60+ best practice sessions 50+ international top speakers…
7月8日(水)
Laravel Cloud security defaults behind every deploy
Laravel Cloud handles WAF, runtime patching, audit logs, network isolation, and package vulnerability scans by default. See what runs in the background.
PHP Tek 2027
Join us for the 19th Annual Web Developer Conference, PHP Tek 2027, April 27-29 2026. PHP Tek combines leadership, expertise, and networking in one event. A relaxing atmosphere for tech leaders and developers to share, learn and grow professionally while also providing you with the knowledge to solve your everyday problems. We are the longest-running web developer conference in the United States, focusing on the PHP programming language. The event is broken up into multiple days. The main conference happens over the course of 3 days (April 27-29) and includes keynotes, talks, and networking o…
7月3日(金)
PHP 8.5.8 Released!
The PHP development team announces the immediate availability of PHP 8.5.8. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.8 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.23 Released!
The PHP development team announces the immediate availability of PHP 8.4.23. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.23 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.6.0 Alpha 1 available for testing
The PHP team is pleased to announce the first testing release of PHP 8.6.0, Alpha 1. This starts the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Alpha 1 please visit the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release a…
PHP 8.3.32 Released!
The PHP development team announces the immediate availability of PHP 8.3.32. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.32 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
7月2日(木)
PHP 8.2.32 Released!
The PHP development team announces the immediate availability of PHP 8.2.32. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.32 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Laravel June product updates
You can now run Symfony apps on Laravel Cloud, managed Valkey caches and object storage are available in Forge, Bus::bulk() for efficient batch dispatch, and MCP client and server tooling across Laravel's AI stack. Here's everything that shipped in June.
6月29日(月)
Your Symfony app now runs on Laravel Cloud
Run your Symfony app on Laravel Cloud. Deploy faster, cut infrastructure costs, and spend your time building features instead of managing hosting.
6月18日(木)
Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper validation Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55808 Description: The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.…
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Server-side request forgery Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55807 Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side request…