Vulnerabilities & updates
Page 21
Fri, May 8
PHP 8.2.31 Released!
The PHP development team announces the immediate availability of PHP 8.2.31. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.31 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.21 Released!
The PHP development team announces the immediate availability of PHP 8.4.21. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.21 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, May 7
PHP 8.3.31 Released!
The PHP development team announces the immediate availability of PHP 8.3.31. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.31 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Python 3.15.0 beta 1 is here!
The propreantepenultimate 3.15 beta is out!
Kubernetes v1.36: Server-Side Sharded List and Watch
As Kubernetes clusters grow to tens of thousands of nodes, controllers that watch high-cardinality resources like Pods face a scaling wall. Every replica of a horizontally scaled controller receives the full stream of events from the API server, paying the CPU, memory, and network cost to deserialize everything, only to discard the objects it is not responsible for. Scaling out the controller does not reduce per-replica cost; it multiplies it. Kubernetes v1.36 introduces server-side sharded list and watch as an alpha feature ( KEP-5866 ). With this feature enabled, the API server filters even…
Wed, May 6
Kubernetes v1.36: Declarative Validation Graduates to GA
In Kubernetes v1.36, Declarative Validation for Kubernetes native types has reached General Availability (GA). For users, this means more reliable, predictable, and better-documented APIs. By moving to a declarative model, the project also unlocks the future ability to publish validation rules via OpenAPI and integrate with ecosystem tools like Kubebuilder. For contributors and ecosystem developers, this replaces thousands of lines of handwritten validation code with a unified, maintainable framework. This post covers why this migration was necessary, how the declarative validation framework…
Tue, May 5
Kubernetes v1.36: Admission Policies That Can't Be Deleted
If you've ever tried to enforce a security policy across a fleet of Kubernetes clusters, you've probably run into a frustrating chicken-and-egg problem. Your admission policies are API objects, which means they don't exist until someone creates them, and they can be deleted by anyone with the right permissions. There's always a window during cluster bootstrap where your policies aren't active yet, and there's no way to prevent a privileged user from removing them. Kubernetes v1.36 introduces an alpha feature that addresses this: manifest-based admission control . It lets you define admission…
Mon, May 4
JetBrains PHPverse 2026
Join us for on June 9 – a global live streaming event dedicated to modern PHP practices and the future of the language. JetBrains PHPverse 2026 This year's lineup features talks by renowned voices in the PHP community, including Larry Garfield, Fabien Potencier, Nils Adermann, Elizabeth Barron, and more. You can tune in for the whole day or drop in for the talks that interest you most. . See the full program here 📅 📍 – free and open to everyone June 9, 2026 Online In 2025, PHPverse reached over 55,000 developers worldwide — be part of it this year! . Register now
Python 3.14.5 release candidate
A special release candidate with a new (old) garbage collector.
Sat, May 2
Laravel April Product Updates
Passkeys, debounceable jobs, MCP UI app support, mobile Cloud, and PHP 8.5 in Forge. Here's everything that shipped in April.
Kubernetes v1.36: Pod-Level Resource Managers (Alpha)
Kubernetes v1.36 introduces Pod-Level Resource Managers as an alpha feature, bringing a more flexible and powerful resource management model to performance-sensitive workloads. This enhancement extends the kubelet's Topology, CPU, and Memory Managers to support pod-level resource specifications ( .spec.resources ), evolving them from a strictly per-container allocation model to a pod-centric one. Why do we need pod-level resource managers? When running performance-critical workloads such as machine learning (ML) training, high-frequency trading applications, or low-latency databases, you ofte…
Fri, May 1
From Zero to Product: A Guide for Building a SaaS with Laravel
Build a production-ready SaaS the Artisan way with Laravel: Starter Kits, Socialite, Cashier, Pennant, and Laravel Cloud.
What's new in Swift: April 2026 Edition
Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. The 1.0 release of valkey-swift was recently announced on the Valkey blog . We’ve invited one of the authors to be this month’s guest contributor: Hi, I’m Adam Fowler, an open source developer working in the Swift on server ecosystem. I am excited to announce the 1.0 release of valkey-swift - a production-grade Swift client for Valkey . Valkey is a high-performance datastore commonly used as a caching layer or message broker in server applications. It is an open source f…
Kubernetes v1.36: In-Place Vertical Scaling for Pod-Level Resources Graduates to Beta
Following the graduation of Pod-Level Resources to Beta in v1.34 and the General Availability (GA) of In-Place Pod Vertical Scaling in v1.35, the Kubernetes community is thrilled to announce that In-Place Pod-Level Resources Vertical Scaling has graduated to Beta in v1.36! This feature is now enabled by default via the InPlacePodLevelResourcesVerticalScaling feature gate. It allows users to update the aggregate Pod resource budget ( .spec.resources ) for a running Pod, often without requiring a container restart. Why Pod-level in-place resize? The Pod-level resource model simplified managemen…
The Easiest and Fastest Way to Build MCP and Claude Apps
Laravel MCP Apps let your MCP tools return live, interactive HTML, all rendered inline inside Claude and VS Code Copilot. One command to scaffold.
Thu, April 30
Scala Days 2026: Call for proposals open
Scala Days 2026: Call for proposals open Submit your talk https://cfp.scaladays.org/scala26/cfp and be part of Scala Days 2026! The Call for Proposals is now open and will close on May 31, 2026, at 23:59 CEST. The Program Committee is looking for talks, labs, and workshops that showcase how Scala is evolving and delivering value in today’s fast-changing technology landscape. In particular, we’re excited to hear practical insights, real-world experience reports, and forward-looking ideas. See the topics below for inspiration. Kind reminder: Super Early Bird tickets are available only until the…
Wed, April 29
Unbound 1.25.0 released
We are pleased to announce the release of version 1.25.0 of the Unbound recursive DNS resolver. This release has some features and a number of bug fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet …
GitLab Patch Release: 18.11.2, 18.10.5
On April 29, 2026, we released versions 18.11.2 and 18.10.5 for GitLab Community Edition and Enterprise Edition. These out-of-band patch releases fix an observability gap to ensure we continue to meet our disaster recovery RTO/RPO commitments for our GitLab Dedicated customers. These versions also resolve a number of regressions and bugs. This patch release does not include any security fixes. GitLab Community Edition and Enterprise Edition 18.11.2 Revert “Merge branch ‘ia-refactor-role-permission-enablement’ into ‘master’” ‘Add Code Suggestion to the DAP supported features for self-hosted mo…
Mon, April 27
Sat, April 25
Fresh 2.3: Zero JS by default, View Transitions, and Temporal support
Fresh 2.3 ships true zero-JS pages, View Transitions, CSP nonce support, IP filtering, and Temporal API support in islands.
Fri, April 24
Laravel Cloud Pre-Check: Is Your App Ready to Deploy?
Run the free Laravel Cloud Pre-Check to get an instant compatibility report for your app. Find out what to fix before you migrate in just a few minutes.
Thu, April 23
Why You Should Consider a Laravel Partner for Your Next Project
Learn more about the Laravel Partner program and why you should choose a Laravel Partner for your next project.
Wed, April 22
GitLab Patch Release: 18.11.1, 18.10.4, 18.9.6
On April 22, 2026, we released versions 18.11.1, 18.10.4, 18.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Schedul…
Mon, April 20
Bun v1.3.13
Fixes 82 issues (addressing 381 👍). bun test --parallel, --isolate, --shard, and --changed, bun install streams tarballs to disk using 17x less memory, source maps use 8x less memory, 5.5x faster gzip with zlib-ng, Range request support in Bun.serve(), SHA3 in node:crypto and WebCrypto, ws+unix:// WebSocket client, and many bugfixes and Node.js compatibility improvements
Fri, April 17
Deploy a Laravel MCP App to Production with Laravel Cloud
Build and deploy a Laravel MCP app on Laravel Cloud. We cover tool implementation, error handling, authentication, testing, and production monitoring.
Thu, April 16
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6367 Description: Drupal 11.3 comes with support for completing entity suggestions whilst adding a link to CKEditor 5. The suggestions aren't sufficiently sanitized and a malicious user could trigger a stored cross site scripting attack against another user. Solution: Install the latest version: If you use Drupal 11.3.x, update to Drup…
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget Chain Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6366 Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or…
Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001
Project: Drupal core Project machine name: drupal Date: 2026-April-15 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >= 8.0.0 < 10.5.9 || >= 10.6.0 < 10.6.7 || >= 11.0.0 < 11.2.11 || >= 11.3.0 < 11.3.7 CVE IDs: CVE-2026-6365 Description: Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to a cross-site scripting (XSS) vulnerability. Solution: Install the latest version: If you use Drupal 10.5.x, update to Drupal 10.5.9 . If yo…
Wed, April 15
Tue, April 14
How I Built an AI-Powered CRM with Laravel in a Week
How a senior freelance developer built a full Laravel MVP in under a week using Laravel Herd, Cloud, and the AI SDK to automate critical workflows.
Last mile towards sbt 2
This post covers work done under the Sovereign Tech Fund investment umbrella: sbt 2 Stable Release and Maintenance . The work is coordinated by the Scala Center . At conferences or on social media, the question we get most often is: When is sbt 2 coming out? We’ll discuss the plan in this post. But let’s go over the status first. What’s new in sbt 2? sbt 2 is a new major version of sbt. If you’re familiar with sbt 1.x, hopefully the jump is not too far, but we have pushed sbt to a more modern standard. The headline features are: sbt 2.x uses Scala 3.x (rather than Scala 2.12) for build defini…
Mon, April 13
Fri, April 10
PHP 8.4.20 Released!
The PHP development team announces the immediate availability of PHP 8.4.20. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.20 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.5.5 Released!
The PHP development team announces the immediate availability of PHP 8.5.5. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.5 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Thu, April 9
Bun v1.3.12
Fixes 120 issues (addressing 219 👍). Render Markdown in the terminal with bun ./file.md, Bun.WebView headless browser automation, in-process Bun.cron() scheduler, async stack traces for native errors, 2.3x faster URLPattern, 2x faster Bun.Glob.scan, cgroup-aware parallelism on Linux, and many bugfixes and Node.js compatibility improvements.
Wed, April 8
Expanding Swift's IDE Support
You can now write Swift in a broader range of popular IDEs, including Cursor, VSCodium, AWS’s Kiro, and Google’s Antigravity. By leveraging VS Code extension compatibility, these editors tap directly into the Open VSX Registry, where the official Swift extension is now live . Swift has long supported development using multiple IDEs including VS Code, Xcode, Neovim, and Emacs. Swift is also compatible with editors that implement the Language Server Protocol (LSP). This growing ecosystem of editor support is particularly significant as Swift continues to show its versatility across platforms an…
GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9
On April 8, 2026, we released versions 18.10.3, 18.9.5, 18.8.9 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled…
Rust for CPython Progress Update April 2026
Rust for CPython project status update April 2026
Tue, April 7
Python 3.15.0a8, 3.14.4 and 3.13.13 are out!
A final alpha and two bug fixes are awaiting your upgrade.
Fri, April 3
runc v1.5.0-rc.2 -- "いざやいざや、見に行かん"
This is the second release candidate of the runc 1.5.0 release. It mostly contains build fixes and improvements, but also includes a new minor feature and some deprecations. runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2 . Users are strongly encouraged to test our release candidates over the next few weeks so we can fix issues before the general release. You should expect runc 1.5.0 to be released at the end of April 2026 (at which point, runc 1.3.z will only receive high-severity security fixes for 6 months and runc 1.2.z will become unmaintained -- users are thus ver…
runc v1.4.2 -- "Я — Земля! Я своих провожаю питомцев"
This is the second patch release of the 1.4.z release series of runc. Fixed A regression in runc v1.3.0 which can result in a stuck runc exec or runc run when the container process runs for a short time. ( #5208 , #5210 , #5216 ) Mount sources that need to be open on the host are now closed earlier during container start, reducing the total amount of used file descriptors and helping to avoid hitting the open files limit when handling many such mounts. ( #5177 , #5201 ) Static Linking Notices The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 l…
Thu, April 2
Meet Maestro: How We Manage 21 Laravel Starter Kit Variants Without Losing Our Minds
Learn how Maestro solves the challenge of maintaining 21 Laravel starter kit variants across 8 repositories, using layered builds, priority-based sync, and a contributor workflow designed to scale.