最新のセキュリティ情報
3 ページ目
6月18日(木)
Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default Vulnerability: Cache poisoning and open redirect Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55806 Description: Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition. This script doesn't correctly check the Host header against…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55804 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execut…
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Project: Drupal core Project machine name: drupal Date: 2026-June-17 Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: PHP object injection Affected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.* CVE IDs: CVE-2026-55803 Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially…
6月17日(水)
Laravel Live Japan 2026 recap
A recap of the first Laravel Live Japan: two days in Tokyo, 550+ attendees from 40 countries, live AI translation, and a community that proved PHP has no borders.
6月15日(月)
How We Built Laravel Cloud’s Scale to Zero
Learn how the Laravel Cloud team built sub-500 ms scale to zero using checkpoint/restore, and how spending limits enforce a hard monthly ceiling for your apps.
6月10日(水)
Provision Laravel Cloud From the Stripe CLI
Laravel Cloud is now available in Stripe Projects. Provision your application, database, cache, and credentials directly from the Stripe CLI.
Laravel AI Agents Now Support MCP Servers
Connect any Laravel AI agent to an MCP server using the Laravel AI SDK and MCP. Supports bearer and OAuth auth, STDIO and HTTP transports, and built-in caching.
6月6日(土)
5 Tips to Save Money on Laravel Cloud
Five ways to reduce your Laravel Cloud bill: enable scale to zero, set a spending cap, use the usage page, switch to managed queues, and share resources.
6月5日(金)
PHP 8.4.22 Released!
The PHP development team announces the immediate availability of PHP 8.4.22. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.22 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Laravel May Product Updates
Full-stack scale-to-zero compute and managed queues on Laravel Cloud, @fonts and MySQL 8.4 in Forge. Here's everything that shipped in May.
6月4日(木)
PHP 8.5.7 Released!
The PHP development team announces the immediate availability of PHP 8.5.7. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.7 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
6月2日(火)
Laracon US 2026
Information: Laracon US 2026 is the flagship Laravel conference, returning to the East Coast on July 28-29, 2026 at the SoWa Power Station in Boston, Massachusetts. Join Laravel and PHP developers from around the world for two days of world-class talks, hands-on learning, and community connection. Come ready to level up, leave ready to ship. July 28-29, 2026 SoWa Power Station, 550 Harrison Ave, Boston, MA, USA 14+ confirmed speakers, including Taylor Otwell and Nuno Maduro Additional events like: — July 27, 3:00 PM Dodgeball — July 27, 4:00 PM Larabelles Meetup — July 27, 8:00 PM Laraprom wi…
6月1日(月)
Your Laravel Cloud Stack Now Scales to Zero and Wakes 20x Faster
Laravel Cloud’s full stack now scales to zero and wakes in under 500 ms. A new $5 Starter plan and spending limits keep your bill in check.
5月28日(木)
WP23
WordPress at 23 is simultaneously both the strongest and most precarious it’s ever been. Last week, we shipped WordPress 7 to the world. In seven days, 46% of all WordPresses, tens of millions across countless different hosting environments, are already on 7.0, auto-updated with no breakage. From a Raspberry Pi to the most secure sites […]
5月25日(月)
Introducing Moat: A Security Review for Your GitHub Account
Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.
5月21日(木)
Migrating a Hybrid Architecture to Laravel Cloud: Top Q&A Questions Answered
Trybe shared how they migrated from Laravel Vapor to Laravel Cloud in a live webinar. Here are the top developer questions from the Q&A, answered.
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Project: Drupal core Project machine name: drupal Date: 2026-May-20 Security risk: Highly critical 23 ∕ 25 AC:None/A:None/CI:All/II:All/E:Exploit/TD:Uncommon Vulnerability: SQL injection Affected versions: >= 8.9.0 < 10.4.10 || >= 10.5.0 < 10.5.10 || >= 10.6.0 < 10.6.9 || >= 11.0.0 < 11.1.10 || >= 11.2.0 < 11.2.12 || >= 11.3.0 < 11.3.10 CVE IDs: CVE-2026-9082 Description: Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted re…
5月15日(金)
Building AI Agents with Laravel: No Python Required
The Laravel AI SDK is the LangChain PHP alternative: agents, tools, memory, streaming, and multi-agent workflows, entirely in PHP. No Python required.
Introducing Laravel PAO: Cleaner Output for AI Agents
Laravel PAO formats PHPUnit, Pest, PHPStan, Rector, and Artisan output into structured JSON for AI agents automatically and without changing your terminal.
Building AI Agents with Laravel: No Python Required
The Laravel AI SDK is the LangChain PHP alternative: agents, tools, memory, streaming, and multi-agent workflows, entirely in PHP.
5月12日(火)
Longhorn PHP 2026 - Call For Papers
Longhorn PHP is back, with a slightly updated format - this year our conference in Austin, TX, will feature a tutorial day (Thursday, October 15), followed by a main conference day (Friday, October 16). We are currently accepting talk and tutorial submissions. While the CFP is open, we also have our Blind Bird tickets available for sale. Register today! Follow us on signup for emails at to get notified with important conference updates. Mastodon longhornphp.com
5月8日(金)
Laravel AI Integration: Build a Document Search Agent
Learn how to build a document search agent with the Laravel AI SDK. Upload files, generate vector embeddings, and stream answers to the browser in real time.
PHP 8.5.6 Released!
The PHP development team announces the immediate availability of PHP 8.5.6. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.6 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.2.31 Released!
The PHP development team announces the immediate availability of PHP 8.2.31. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.31 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.21 Released!
The PHP development team announces the immediate availability of PHP 8.4.21. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.21 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
5月7日(木)
PHP 8.3.31 Released!
The PHP development team announces the immediate availability of PHP 8.3.31. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.31 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
5月4日(月)
JetBrains PHPverse 2026
Join us for on June 9 – a global live streaming event dedicated to modern PHP practices and the future of the language. JetBrains PHPverse 2026 This year's lineup features talks by renowned voices in the PHP community, including Larry Garfield, Fabien Potencier, Nils Adermann, Elizabeth Barron, and more. You can tune in for the whole day or drop in for the talks that interest you most. . See the full program here 📅 📍 – free and open to everyone June 9, 2026 Online In 2025, PHPverse reached over 55,000 developers worldwide — be part of it this year! . Register now
5月2日(土)
Laravel April Product Updates
Passkeys, debounceable jobs, MCP UI app support, mobile Cloud, and PHP 8.5 in Forge. Here's everything that shipped in April.
5月1日(金)
From Zero to Product: A Guide for Building a SaaS with Laravel
Build a production-ready SaaS the Artisan way with Laravel: Starter Kits, Socialite, Cashier, Pennant, and Laravel Cloud.
The Easiest and Fastest Way to Build MCP and Claude Apps
Laravel MCP Apps let your MCP tools return live, interactive HTML, all rendered inline inside Claude and VS Code Copilot. One command to scaffold.
4月24日(金)
Laravel Cloud Pre-Check: Is Your App Ready to Deploy?
Run the free Laravel Cloud Pre-Check to get an instant compatibility report for your app. Find out what to fix before you migrate in just a few minutes.
4月23日(木)
Why You Should Consider a Laravel Partner for Your Next Project
Learn more about the Laravel Partner program and why you should choose a Laravel Partner for your next project.
4月17日(金)
Deploy a Laravel MCP App to Production with Laravel Cloud
Build and deploy a Laravel MCP app on Laravel Cloud. We cover tool implementation, error handling, authentication, testing, and production monitoring.
4月16日(木)
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6367 Description: Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user. Solution: Install the latest version: If you use Drupal 11.3.x, update to Drup…
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6366 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or…
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6365 Description: Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: If you use Drupal 10.5.x, update to Drupal 10.5.9 . If yo…
4月14日(火)
How I Built an AI-Powered CRM with Laravel in a Week
How a senior freelance developer built a full Laravel MVP in under a week using Laravel Herd, Cloud, and the AI SDK to automate critical workflows.
4月10日(金)
PHP 8.4.20 Released!
The PHP development team announces the immediate availability of PHP 8.4.20. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.20 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.5.5 Released!
The PHP development team announces the immediate availability of PHP 8.5.5. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.5 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
4月2日(木)
Meet Maestro: How We Manage 21 Laravel Starter Kit Variants Without Losing Our Minds
Learn how Maestro solves the challenge of maintaining 21 Laravel starter kit variants across 8 repositories, using layered builds, priority-based sync, and a contributor workflow designed to scale.
Laravel March Product Updates
# Laravel March Product Updates March was a big month for product updates. Laravel 13 brings first-party AI tooling to the framework, Laravel Cloud now has a free trial with no credit card required,...
3月28日(土)
Laravel AI SDK: Building Production-Safe Database Tools for Agents
Build production-safe database tools with the Laravel AI SDK. Scope Eloquent queries by user, add vector search with SimilaritySearch, and prevent prompt injection.
3月27日(金)
Cutting Laravel Cloud Load Times by 60% with Nightwatch
How we cut environment dashboard response times from 907ms to 354ms with Laravel Nightwatch by fixing N+1 queries, redundant data, and deferring load.
3月26日(木)
Scheduled Autoscaling for Laravel Cloud
You can now [define a scaling schedule on Laravel Cloud](https://laravel.com/cloud/docs/compute#scheduled-autoscaling) and let it handle the rest. Set your autoscaling limits once for each traffic win...
Inertia v3: What's Changed Since the First Beta
What changed in Inertia v3 since the first beta: simpler layout props, Vite 8 support, a withApp callback, and new Blade components.
3月25日(水)
K6 Load Testing on Laravel Cloud: 17,000 Requests per Second and Autoscaling Under Pressure
Learn how to load test a Laravel app with k6: 20,000 virtual users, bimodal latency jitter, and Laravel Cloud autoscaling under real pressure. Here's what happened.
3月20日(金)
Laravel Cloud CLI: Deploy and Manage Laravel Apps from the Terminal
The Laravel Cloud CLI lets you deploy Laravel apps, manage environments, and run Artisan commands from the terminal. Install via Composer and skip the dashboard.
3月18日(水)
Which AI Model Is Best for Laravel?
We benchmarked 6 AI models on 17 real Laravel tasks, with and without Laravel Boost. See which model wins, which fails, and by how much.
Managed Databases Are Now Available in Laravel Forge
Let Laravel Forge handle managed Postgres clusters for you with automated backups, PITR, high availability, and monitoring, all from your Forge dashboard.
3月14日(土)
Building Multi-Agent Workflows with the Laravel AI SDK
Build Anthropic's five multi-agent patterns with the Laravel AI SDK, from prompt chaining and routing to parallelization, and more.