Vulnerabilities & updates

PHP 8.4.22 Released!

The PHP development team announces the immediate availability of PHP 8.4.22. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.22 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

Scala 3.8.4 is now available!

Release highlights Security audit fixes Scala 3.8.4 includes improvements and fixes for issues discovered during the Scala codebase security audit carried out in collaboration with the Open Source Technology Improvement Fund and Quarkslab. Notable fixes in this release include: Hardened TASTy parsing to prevent infinite loops on maliciously crafted files ( #25676 ) Fixed a stored XSS vulnerability in Scaladoc ( #25681 ) Improved error handling in scala.sys.process.Parser.tokenize ( #25675 ) Fixed TastyPrinter’s JAR-walking logic to include subdirectories ( #25678 ) :help syntax for all compil…

Laravel May Product Updates

Full-stack scale-to-zero compute and managed queues on Laravel Cloud, @fonts and MySQL 8.4 in Forge. Here's everything that shipped in May.

PHP 8.5.7 Released!

The PHP development team announces the immediate availability of PHP 8.5.7. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.7 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog

Announcing the Networking Workgroup

The Swift Ecosystem Steering Group is excited to announce the creation of the Networking workgroup ! Workgroups are community-led efforts, formally recognized by the project, to advance key areas of Swift. The primary goal is to guide the evolution of networking libraries, protocols, and APIs in the Swift ecosystem, making networking in Swift excellent everywhere: high-level and safe by default, modular and interoperable, cross-platform, and observable. Networking is one of the most common entry points for Swift developers, and the ecosystem has matured significantly over the years. Foundatio…

What's new in Swift: May 2026 Edition

Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. To start, we’re focusing on some of the many local meetup groups sharing Swift content: Around the world, local meetup groups and conferences bring Swift developers together, and some even predate Swift itself! Many have YouTube channels where they share videos from their events, so you can tune in remotely. Let’s highlight a few. In May the SF Swift meetup hosted a talk by Dan Federman, Agentify Your Swift Repo , which covers building an agent for CI and review feedback…

Elixir v1.20 released: now a gradually typed language

From Elixir v1.20, every program is now gradually type checked in search for verified bugs and typing violations.

Python 3.15.0 beta 2 is here!

The antepenultimate 3.15 beta is out!

From Kubernetes Dashboard to Headlamp: Understanding the Transition

For many people, Kubernetes Dashboard was their first window into Kubernetes. It offered a simple visual way to see what was running in a cluster, inspect resources, and build confidence without relying on the command line. For years, it helped developers, students, and operators make sense of Kubernetes, and it served as an important onramp into the ecosystem. The Kubernetes Dashboard project has now been archived. We deeply respect the work the team did and the role Dashboard played in making Kubernetes more approachable for so many users. Headlamp builds on that foundation and carries it f…

Laracon US 2026

Information: Laracon US 2026 is the flagship Laravel conference, returning to the East Coast on July 28-29, 2026 at the SoWa Power Station in Boston, Massachusetts. Join Laravel and PHP developers from around the world for two days of world-class talks, hands-on learning, and community connection. Come ready to level up, leave ready to ship. July 28-29, 2026 SoWa Power Station, 550 Harrison Ave, Boston, MA, USA 14+ confirmed speakers, including Taylor Otwell and Nuno Maduro Additional events like: — July 27, 3:00 PM Dodgeball — July 27, 4:00 PM Larabelles Meetup — July 27, 8:00 PM Laraprom wi…

Your Laravel Cloud Stack Now Scales to Zero and Wakes 20x Faster

Laravel Cloud’s full stack now scales to zero and wakes in under 500 ms. A new $5 Starter plan and spending limits keep your bill in check.

Node.js 26.3.0 (Current)

Bringing Goodnotes to the web with Swift and WebAssembly

Goodnotes has been helping millions of users take handwritten notes on iPad for over a decade, earning recognition as Apple’s iPad App of the Year in 2022. Today, the same Swift code that powers our iOS app also runs seamlessly in web browsers through WebAssembly, delivering the exact same ink rendering and note-taking experience users love. This journey demonstrates that Swift excels as a cross-platform language, running high-performance applications while sharing the same codebase. Every bug fix and improvement to Goodnotes benefits all our users simultaneously, regardless of which platform…

Scala Codebase Security Audit Complete

This post covers work done under the Sovereign Tech Fund investment umbrella: Maintenance of the Standard Library/Core Library Modules and APIs . The work is coordinated by the Scala Center . The Scala Center is proud to share the first results of the security audit of Scala carried out in collaboration with Open Source Technology Improvement Fund and the security researchers at Quarkslab . The audit was divided into two major parts: an assessment of the Scala 3 compiler and Scala standard library codebases, and a separate review of Scala’s supply-chain security. This first publication focuse…

WP23

WordPress at 23 is simultaneously both the strongest and most precarious it’s ever been. Last week, we shipped WordPress 7 to the world. In seven days, 46% of all WordPresses, tens of millions across countless different hosting environments, are already on 7.0, auto-updated with no breakage. From a Raspberry Pi to the most secure sites […]

GitLab Patch Release: 18.9.8, 18.8.10, 18.7.7, 18.6.8, 18.5.7

Today, we are releasing versions 18.9.8, 18.8.10, 18.7.7, 18.6.8, and 18.5.7 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. This patch release does not include any security fixes. This patch release addresses a regression introduced in GitLab 18.4 where issues appeared duplicated in Epic swimlane board views — showing under both their direct parent epic and the grandparent epic — even when no filter was applied. This caused boards to become cluttered and made iteration planning unreliable for teams using nested epic hierarchies. T…

Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs

The Kubernetes project relies on transparency to empower cluster administrators and security researchers. One important way we do that is by publishing CVE records into the Common Vulnerabilities and Exposures database. As part of our ongoing effort to mature the official Kubernetes CVE Feed , we have identified some discrepancies. CVE records for a few older, unfixed issues incorrectly include a fixed version field. The Kubernetes Security Response Committee (SRC) will correct the affected CVE records on June 1, 2026. This may result in vulnerability scanners identifying these vulnerabilitie…

Introducing Moat: A Security Review for Your GitHub Account

Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.

Deno 2.8

`import defer`, six new subcommands (`deno transpile`, `deno pack`, `deno bump-version`, `deno ci`, `deno why`, `deno audit fix`), network debugging in Chrome DevTools, framework-aware `deno compile`, and 3.66x faster cold npm installs.

Claw Patrol: an open-source security firewall for agents

Why we needed an agent firewall that speaks more than HTTP.

Migrating a Hybrid Architecture to Laravel Cloud: Top Q&A Questions Answered

Trybe shared how they migrated from Laravel Vapor to Laravel Cloud in a live webinar. Here are the top developer questions from the Q&A, answered.

Node.js 24.16.0 (LTS)

Introducing the pkg.go.dev API

Introducing the new programmatic API for pkg.go.dev, allowing developers to fetch package and module data directly.

Node.js 26.2.0 (Current)

Unbound 1.25.1 released

We are pleased to announce the release of version 1.25.1 of the Unbound recursive DNS resolver. This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing …

Ruby 4.0.5 Released

Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065] . Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.6 will be released in July, 4.0.7 in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than plann…

Announcing etcd 3.7.0-beta.0

SIG-Etcd announces the availability of the first beta release of etcd v3.7.0 . This new version of the popular distributed database and key Kubernetes component includes the long-requested RangeStream feature, as well as a refactoring and cleanup of multiple legacy components and interfaces. v3.7 will deliver improved security, better operational reliability, and an improved experience for working with large resultsets. First, however, the project needs users to test the beta. You can find v3.7.0-beta.0 here: Source code Binaries Official container images Please try it out and report issues i…

CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…

Kubernetes v1.36: New Metric for Route Sync in the Cloud Controller Manager

This article was originally published with the wrong date. It was later republished, dated the 15th of May 2026. Kubernetes v1.36 introduces a new alpha counter metric route_controller_route_sync_total to the Cloud Controller Manager (CCM) route controller implementation at k8s.io/cloud-provider . This metric increments each time routes are synced with the cloud provider. A/B testing watch-based route reconciliation This metric was added to help operators validate the CloudControllerManagerWatchBasedRoutesReconciliation feature gate introduced in Kubernetes v1.35 . That feature gate switches…

Building AI Agents with Laravel: No Python Required

The Laravel AI SDK is the LangChain PHP alternative: agents, tools, memory, streaming, and multi-agent workflows, entirely in PHP. No Python required.

Introducing Laravel PAO: Cleaner Output for AI Agents

Laravel PAO formats PHPUnit, Pest, PHPStan, Rector, and Artisan output into structured JSON for AI agents automatically and without changing your terminal.

Building AI Agents with Laravel: No Python Required

The Laravel AI SDK is the LangChain PHP alternative: agents, tools, memory, streaming, and multi-agent workflows, entirely in PHP.

Kubernetes v1.36: Deprecation and removal of Service ExternalIPs

The .spec.externalIPs field for Service was an early attempt to provide cloud-load-balancer-like functionality for non-cloud clusters. Unfortunately, the API assumes that every user in the cluster is fully trusted, and in any situation where that is not the case, it enables various security exploits, as described in CVE-2020-8554 . Since Kubernetes 1.21, the Kubernetes project has recommended that all users disable .spec.externalIPs . To make that easier, Kubernetes also added an admission controller ( DenyServiceExternalIPs ) that can be enabled to do this. At the time, SIG Network felt that…

Node.js 22.22.3 (LTS)

Kubernetes v1.36: Advancing Workload-Aware Scheduling

AI/ML and batch workloads introduce unique scheduling challenges that go beyond simple Pod-by-Pod scheduling. In Kubernetes v1.35, we introduced the first tranche of workload-aware scheduling improvements, featuring the foundational Workload API alongside basic gang scheduling support built on a Pod-based framework, and an opportunistic batching feature to efficiently process identical Pods. Kubernetes v1.36 introduces a significant architectural evolution by cleanly separating API concerns: the Workload API acts as a static template, while the new PodGroup API handles the runtime state. To s…

Bun v1.3.14

Fixes 92 issues (addressing 380 👍). Bun.Image — a built-in image processing API, 7x faster warm installs with the isolated linker's global store, experimental HTTP/2 and HTTP/3 clients for fetch(), HTTP/3 (QUIC) in Bun.serve(), rewritten fs.watch() on Linux and macOS, --no-orphans CLI flag, process.execve(), Bun.Terminal on Windows via ConPTY, FreeBSD and Android builds, shared SSL_CTX cache, smaller binaries, and many bugfixes and Node.js compatibility improvements.

Kubernetes v1.36: PSI Metrics for Kubernetes Graduates to GA

Since its original implementation in the Linux kernel in 2018, Pressure Stall Information (PSI) has provided users with the high-fidelity signals needed to identify resource saturation before it becomes an outage. Unlike traditional utilization metrics, PSI tells the story of tasks stalled and time lost, all in nicely-packaged percentages of time across the CPU, memory, and I/O. With the recent release of Kubernetes v1.36, users across the ecosystem have a stable, reliable interface to observe resource contention at the node, pod, and container levels. In this post, we will dive into the impr…

Microsoft 製品の脆弱性対策について(2026年5月)

「GUARDIANWALL MailSuite」におけるスタックベースのバッファオーバーフローの脆弱性について（JVN#35567473）

Longhorn PHP 2026 - Call For Papers

Longhorn PHP is back, with a slightly updated format - this year our conference in Austin, TX, will feature a tutorial day (Thursday, October 15), followed by a main conference day (Friday, October 16). We are currently accepting talk and tutorial submissions. While the CFP is open, we also have our Blind Bird tickets available for sale. Register today! Follow us on signup for emails at to get notified with important conference updates. Mastodon longhornphp.com

Ruby 4.0.4 Released

Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.tar.gz SIZE: 23816838 SHA1: 363…

Python 3.14.5 is out!

A special release with a new (old) garbage collector.

Kubernetes v1.36: Moving Volume Group Snapshots to GA

Volume group snapshots were introduced as an Alpha feature with the Kubernetes v1.27 release, moved to Beta in v1.32, and to a second Beta in v1.34. We are excited to announce that in the Kubernetes v1.36 release, support for volume group snapshots has reached General Availability (GA) . The support for volume group snapshots relies on a set of extension APIs for group snapshots . These APIs allow users to take crash-consistent snapshots for a set of volumes. Behind the scenes, Kubernetes uses a label selector to group multiple PersistentVolumeClaim objects for snapshotting. A key aim is to a…

Laravel AI Integration: Build a Document Search Agent

Learn how to build a document search agent with the Laravel AI SDK. Upload files, generate vector embeddings, and stream answers to the browser in real time.

PHP 8.5.6 Released!

The PHP development team announces the immediate availability of PHP 8.5.6. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.6 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog