From Laravel Blog
Wed, October 21
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
Wed, July 8
Laravel Cloud security defaults behind every deploy
Laravel Cloud handles WAF, runtime patching, audit logs, network isolation, and package vulnerability scans by default. See what runs in the background.
Mon, May 25
Introducing Moat: A Security Review for Your GitHub Account
Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.
Sat, March 14
Laravel MCP Server: Auth & Security Best Practices
Add authentication to your Laravel MCP server without writing an authorization server. Plus, security best practices.
Fri, October 10
Fullstack Cybersecurity with Laravel. The Artisan of the Day Is Akhila Sreekumar.
Akhila Sreekumar shares her journey from India to Sweden, using Laravel to build fullstack cybersecurity apps and grow her career.
Laravel Nightwatch Achieves SOC 2 Type 1 Certification
Laravel Nightwatch achieves SOC 2 Type 1 certification, enhancing security and compliance for monitoring Laravel applications in enterprise environments.
Sun, September 21
Bringing Security to the Laravel Community. The Artisan of the Day Is Stephen Rees-Carter.
Stephen Rees-Carter, security expert and Laravel educator, shares his journey, tools, and advice for building secure, impactful apps.
Fri, September 5
Laravel Cloud Achieves SOC 2 Type 2 Certification, Nightwatch and Forge Next
Laravel Cloud achieves SOC 2 Type 2 certification for Security, Confidentiality, and Availability. Read how Laravel's compliance roadmap includes Nightwatch and Forge SOC 2 audits.
Mon, July 8
Improving Laravel Application Security with Aikido
As your Laravel application grows, managing security objectives becomes more challenging, especially for small teams or solo developers. Today, Laravel has teamed up with Aikido to provide a seamless solution for securing your Laravel application. With Aikido, Laravel developers using Forge can effortlessly scan for and identify potential security vulnerabilities, all in less than 1 minute.
Wed, December 15
Log4j Vulnerability Update
Log4j is a Java library by Apache used to log debug messages within applications. It's recently been featured in news outlets around the world due to a vulnerability (known as Log4Shell) that was discovered allowing remote code execution using a specific string.
Tue, May 4
Vapor: Redis 6.x Clusters Are Now Available
Starting today, in addition to Redis 5.x Clusters, you may now also create and manage Redis 6.x Clusters. Redis 6.x is the latest version of open-source Redis software. This new version brings improved security and boosts the performance of your cache.
Wed, April 28
Security: SQL Injection in SQL Server "LIMIT" / "OFFSET"
Today we have released security patches via Laravel 6.20.26 and 8.40.0. These patches resolve a security vulnerability that allowed SQL injection when unfiltered user input was passed directly to the...
Fri, March 19
Forge: Session Changes
On the morning of March 18th all Laravel Forge sessions were manually logged out. This was done so that we could enable a new security feature in Forge that allows you to manage other browser sessions...
Sat, January 16
Security: Laravel 6.20.12, 7.30.3 Released
Earlier this week we released a security update to address a problem with query parameter binding in Laravel. However, the 6.x and 7.x releases were done before the Git sub-tree splits had completed r...
Thu, January 14
Security: Laravel 6.20.11, 7.30.2, 8.22.1 Released
This morning we released Laravel 6.20.11, 7.30.2, and 8.22.1. These updates contain a security related patch; therefore, we encourage all Laravel users to update their applications as soon as possible...
Fri, January 8
Security: Fortify 1.7.4. Released
We have reverted a pull request that was merged into Laravel Fortify 1.7.3 which introduced a potential security vulnerability. Please update your applications using Fortify 1.7.3, including all Jetst...
Tue, November 17
Vapor: Load Balancer Security Policy Updates
Beginning today, all new load balancers will use a security policy that no longer supports TLS 1.0 and TLS 1.1.
Sat, August 8
Security Release: Laravel 6.18.35, 7.24.0
**Note: This security patch only affects applications using the `$guarded` property on models. In addition, applications that set `$guarded` to `[]` or `['*']` are not affected by the bug described in...
Fri, August 7
Security Release: Laravel 6.18.34, 7.23.2
Today we released a security patch for Laravel 6.x and 7.x. In previous releases of Laravel, it was possible to mass assign Eloquent attributes that included the model's table name: ``` $model->fill...
Tue, July 28
Laravel Cookie Security Releases
Today we released several fixes to address a security vulnerability in the framework that we were notified of during the weekend. Application's using the "cookie" session driver were the primary appl...
Mon, July 27
Security Release: Laravel 6.18.29, 7.22.2
Today we have released a security patch for Laravel versions 6.x and 7.x. These releases have been released as Laravel 6.18.29 and 7.22.2. All Laravel users are encouraged to upgrade to these versions...
Fri, March 13
Security: Laravel 7.1.2 Released
Today we released Laravel 7.1.2 to address a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel...
Tue, March 19
Unique Rule SQL Injection Warning
Yesterday I received an email from a security researcher pointing out the possibility of SQL injection when user controlled input is passed as the...