最新のセキュリティ情報
10月24日(土)昨日
Laravel TokenGuard authentication bypass through non-string API credentials
影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0 Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…
Laravel relationship inclusion can trigger unauthorized data destruction
影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0 A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…
10月23日(金)
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed
10月21日(水)
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
7月8日(水)
Laravel Cloud security defaults behind every deploy
Laravel Cloud handles WAF, runtime patching, audit logs, network isolation, and package vulnerability scans by default. See what runs in the background.
5月25日(月)
Introducing Moat: A Security Review for Your GitHub Account
Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.
3月14日(土)
Laravel MCP Server: Auth & Security Best Practices
Add authentication to your Laravel MCP server without writing an authorization server. Plus, security best practices.
10月10日(金)
Fullstack Cybersecurity with Laravel. The Artisan of the Day Is Akhila Sreekumar.
Akhila Sreekumar shares her journey from India to Sweden, using Laravel to build fullstack cybersecurity apps and grow her career.
Laravel Nightwatch Achieves SOC 2 Type 1 Certification
Laravel Nightwatch achieves SOC 2 Type 1 certification, enhancing security and compliance for monitoring Laravel applications in enterprise environments.
9月21日(日)
Bringing Security to the Laravel Community. The Artisan of the Day Is Stephen Rees-Carter.
Stephen Rees-Carter, security expert and Laravel educator, shares his journey, tools, and advice for building secure, impactful apps.
9月8日(月)
PHPKonf 2025 Baku
PHPKonf 2025 will take place on October 26, 2025 in Baku, Azerbaijan, bringing together PHP developers, software engineers, and technology enthusiasts from the local and international community. This one-day conference will feature practical talks and case studies on PHP and its ecosystem, including frameworks such as Laravel and Symfony, as well as modern practices in testing, security, architecture, and performance optimization. Participants will have the opportunity to connect with experienced speakers, exchange knowledge with peers, and explore real-world solutions to everyday development…
9月5日(金)
Laravel Cloud Achieves SOC 2 Type 2 Certification, Nightwatch and Forge Next
Laravel Cloud achieves SOC 2 Type 2 certification for Security, Confidentiality, and Availability. Read how Laravel's compliance roadmap includes Nightwatch and Forge SOC 2 audits.
7月8日(月)
Improving Laravel Application Security with Aikido
As your Laravel application grows, managing security objectives becomes more challenging, especially for small teams or solo developers. Today, Laravel has teamed up with Aikido to provide a seamless solution for securing your Laravel application. With Aikido, Laravel developers using Forge can effortlessly scan for and identify potential security vulnerabilities, all in less than 1 minute.
12月15日(水)
Log4j Vulnerability Update
Log4j is a Java library by Apache used to log debug messages within applications. It's recently been featured in news outlets around the world due to a vulnerability (known as Log4Shell) that was discovered allowing remote code execution using a specific string.
5月4日(火)
Vapor: Redis 6.x Clusters Are Now Available
Starting today, in addition to Redis 5.x Clusters, you may now also create and manage Redis 6.x Clusters. Redis 6.x is the latest version of open-source Redis software. This new version brings improved security and boosts the performance of your cache.
4月28日(水)
Security: SQL Injection in SQL Server "LIMIT" / "OFFSET"
Today we have released security patches via Laravel 6.20.26 and 8.40.0. These patches resolve a security vulnerability that allowed SQL injection when unfiltered user input was passed directly to the...
3月19日(金)
Forge: Session Changes
On the morning of March 18th all Laravel Forge sessions were manually logged out. This was done so that we could enable a new security feature in Forge that allows you to manage other browser sessions...
1月16日(土)
Security: Laravel 6.20.12, 7.30.3 Released
Earlier this week we released a security update to address a problem with query parameter binding in Laravel. However, the 6.x and 7.x releases were done before the Git sub-tree splits had completed r...
1月14日(木)
Security: Laravel 6.20.11, 7.30.2, 8.22.1 Released
This morning we released Laravel 6.20.11, 7.30.2, and 8.22.1. These updates contain a security related patch; therefore, we encourage all Laravel users to update their applications as soon as possible...
1月8日(金)
Security: Fortify 1.7.4. Released
We have reverted a pull request that was merged into Laravel Fortify 1.7.3 which introduced a potential security vulnerability. Please update your applications using Fortify 1.7.3, including all Jetst...
11月17日(火)
Vapor: Load Balancer Security Policy Updates
Beginning today, all new load balancers will use a security policy that no longer supports TLS 1.0 and TLS 1.1.
8月8日(土)
Security Release: Laravel 6.18.35, 7.24.0
**Note: This security patch only affects applications using the `$guarded` property on models. In addition, applications that set `$guarded` to `[]` or `['*']` are not affected by the bug described in...
8月7日(金)
Security Release: Laravel 6.18.34, 7.23.2
Today we released a security patch for Laravel 6.x and 7.x. In previous releases of Laravel, it was possible to mass assign Eloquent attributes that included the model's table name: ``` $model->fill...
7月28日(火)
Laravel Cookie Security Releases
Today we released several fixes to address a security vulnerability in the framework that we were notified of during the weekend. Application's using the "cookie" session driver were the primary appl...
7月27日(月)
Security Release: Laravel 6.18.29, 7.22.2
Today we have released a security patch for Laravel versions 6.x and 7.x. These releases have been released as Laravel 6.18.29 and 7.22.2. All Laravel users are encouraged to upgrade to these versions...
3月13日(金)
Security: Laravel 7.1.2 Released
Today we released Laravel 7.1.2 to address a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel...
3月19日(火)
Unique Rule SQL Injection Warning
Yesterday I received an email from a security researcher pointing out the possibility of SQL injection when user controlled input is passed as the...
2月19日(金)
php[tek] 2016
The team at is excited this year to bring you the 11th edition of one of the longest running PHP conference in the world: — running from May 23th-27th. php[architect] php[tek] 2016 This year we have moved the conference to a , in St. Louis, in order to expand this year and for years to come. bigger venue We've finally announced our for the year and will be featuring: schedule A two-day long PHP Essentials Training Class 2 different full-day training classes (on Laravel & Web Security) 6 half-day tutorial session 46 sessions ... and 3 amazing keynotes by community members! We also are planning…