Vulnerabilities & updates
Page 25
Thu, December 4
React Server Functions / Next.js Vulnerability: Deno Deploy users protected
A critical Remote Code Execution (RCE) vulnerability has been found in React Server Functions and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other users.
Wed, December 3
Critical Security Vulnerability in React Server Components
There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
Laravel November Product Releases
Laravel’s November product updates for Laravel Cloud, Forge, Nightwatch, and Laravel 12.x.
Tue, December 2
Bun is joining Anthropic
Bun has been acquired by Anthropic. Anthropic is betting on Bun as the infrastructure powering Claude Code, Claude Agent SDK, and future AI coding products & tools.
Lazier Binary Decision Diagrams (BDDs) for set-theoretic types
This article explores the data structures used to represent set-theoretic types and the recent optimizations we have applied to them.
Python 3.13.10 is now available, too, you know!
The latest version of Python 3.13 is now available! Python 3.13.10 https://www.python.org/downloads/release/python-31310/ This is the tenth maintenance rel...
Sun, November 30
Laravel Live Japan
Laravel Live Japan is the first official Laravel community conference in Japan. It brings together developers, designers, and tech enthusiasts from around the world to share knowledge, exchange ideas, and celebrate the craft of building with Laravel. Join us in Tokyo at Tachikawa Stage Garden on May 26-27, 2026 for this premiere event. Enjoy two days of inspiring talks, hands-on learning, and unforgettable community experiences. Basic info Date: May 26-27, 2026 (JST) Location: Tachikawa City, Tokyo Prefecture, Japan Links Website: https://laravellive.jp X: https://x.com/LaravelLiveJP
Sat, November 29
Building Laravel Mauritius. The Artisan of the Day Is Percy Mamedy.
Percy Mamedy shares how Laravel transformed his career and inspired him to build Laravel Moris, a thriving developer community in Mauritius.
Fri, November 28
Best Practices for Scalable Cloud Infrastructure with Laravel Cloud
Tips for scaling cloud infrastructure in Laravel Cloud: set smart baselines, tune autoscaling triggers, and optimize replicas for stable performance.
Wed, November 26
GitLab Patch Release: 18.6.1, 18.5.3, 18.4.5
On November 26, 2025, we released versions 18.6.1, 18.5.3, 18.4.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Schedu…
Unbound 1.24.2 released
We are pleased to announce the release of version 1.24.2 of the Unbound recursive DNS resolver. This security release provides an additional fix for CVE-2025-11411. Promiscuous NS RRSets that complement DNS replies in the authority section can be used to trick resolvers to update their delegation information for …
Tue, November 25
Fri, November 21
Bun v1.3.3
Fixes 95 issues (addressing 348 👍). CompressionStream and DecompressionStream, Control .env and bunfig.toml loading in standalone executables, `retry` and `repeats` in `bun:test`, --no-env-file, SQLite 3.51.0, Upgraded to Zig 0.15.2, Bugfixes for bundler, bun install, Windows, Node.js compatibility, Web APIs, Bun.serve, networking, Bun.YAML, Bun.Transpiler, Bun.spawn & TypeScript definitions
PHP 8.5.0 Released!
The PHP development team announces the immediate availability of PHP 8.5.0. This release marks the latest minor release of the PHP language. PHP 8.5 comes with numerous improvements and new features such as: New "URI" extension New pipe operator (|>) Clone With New #[\NoDiscard] attribute Support for closures, casts, and first class callables in constant expressions And much much more... For source downloads of PHP 8.5.0 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog The is available in the PHP Manual.…
Thu, November 20
PHP 8.4.15 Released!
The PHP development team announces the immediate availability of PHP 8.4.15. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.15 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.28 Released!
The PHP development team announces the immediate availability of PHP 8.3.28. This is a bug fix release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.28 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Wed, November 19
Laravel Developer-Turned-Educator. The Artisan of the Day Is Pete Heslop.
Pete Heslop shares how "Laravel for the Rest of Us" was created, why non-technical teams need shared language, and how his agency built a decade on Laravel.
Mon, November 17
Sat, November 15
Fixing Errors and Empowering Laravel Artisans. The Artisan of the Day Is Punyapal Shah.
A freelancer and community leader, Punyapal Shah built Laravel Artisans and became a voice in India’s Laravel scene through open source and livestreams.
Fri, November 14
PHP 8.5.0 RC 5 available for testing
The PHP team is pleased to announce the fifth release candidate of PHP 8.5.0, RC 5. This continues the PHP 8.5 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.5.0 RC5, please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is a test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS UPGRAD…
Introducing WebSockets for Laravel Cloud, Powered by Laravel Reverb
Launch real-time features in seconds with WebSockets for Laravel Cloud: managed Laravel Reverb clusters for up to 50% less than third-party tools.
Thu, November 13
Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13083 Description: The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the system module. In some cases, files may be served with the HTTP header Cache-…
Drupal core - Moderately critical - Defacement - SA-CORE-2025-007
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Defacement Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13082 Description: By generating and tricking a user into visiting a malicious URL, an attacker can perform site defacement. The defacement is not stored and is only present when the URL has been crafted for that purpose. Only the defacement is present, so no other site content (suc…
Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Gadget chain Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13081 Description: Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution if the…
Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
Project: Drupal core Project machine name: drupal Date: 2025-November-12 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Denial of Service Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8 CVE IDs: CVE-2025-13080 Description: Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not.…
Wed, November 12
GitLab Patch Release: 18.5.2, 18.4.4, 18.3.6
On November 12, 2025, we released versions 18.5.2, 18.4.4, 18.3.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Schedu…
Sat, November 8
Bun v1.3.2
Fixes 287 issues (addressing 324 👍). Hoisted installs restored as default for backward compatibility. CPU profiling with --cpu-prof, faster installs for packages with post-install scripts, bun:test onTestFinished hook, ServerWebSocket subscriptions getter, Alpine 3.22 in Docker images, improved Git dependency resolution, bun list alias, and numerous bug fixes across install, HTTP/HTTPS, N-API, bun test, bun build, and runtime.
Building Community and Innovation with Laravel Senegal: The Artisan of the Day Is Idrissa Ndiouck.
Idrissa Ndiouck, co-founder of Laravel Senegal and developer at GBG, is using Laravel to empower a new generation of African developers and innovators.
Fri, November 7
PHP 8.5.0 RC4 available for testing
The PHP team is pleased to announce the final planned release candidate of PHP 8.5.0, RC 4. This continues the PHP 8.5 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.5.0 RC4, please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is a test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEW…
Sat, November 1
Taking Laravel Across the Pond: The Artisan of the Day Is Bill Mitchell.
Bill Mitchell shares his Laravel journey from Vancouver Island to Scotland, building quality software at Isolocity and launching his music app, RadioPuppy.
Fri, October 31
betterCode() PHP 2025
With version 8.5, PHP continues to evolve in its thirtieth year: the new pipe operator and numerous performance improvements make your development more efficient. At the same time, FrankenPHP is establishing itself in Caddy Server, a European open-source solution, as a modern alternative to Nginx. betterCode() PHP supports you in using PHP 8.5, switching to FrankenPHP and the Caddy Server. Artificial intelligence is also part of the software development toolkit today: if you want to use it effectively, you need clear architectures, clean code, and solid patterns. is an online conference lasti…
Thu, October 30
How to Fix 502 Error: PHP-FPM Socket Issues in PHP/Laravel Forge
Learn how missing or broken PHP-FPM sockets cause 502 Bad Gateway issues in Nginx, and how to restart PHP-FPM to resolve them.
Wed, October 29
Vercel now supports the Bun Runtime
Deploy and run your applications with Bun's fast JavaScript runtime on Vercel Functions, with full access to Bun APIs and improved performance
Sat, October 25
From .NET to Laravel: The Artisan of the Day Is Bilal Haidar.
Bilal Haidar is a Laravel expert who builds full-stack platforms, leveraging the framework’s productivity features and mentoring others in the ecosystem.
Fri, October 24
PHP 8.3.27 Released!
The PHP development team announces the immediate availability of PHP 8.3.27. This is a bug fix release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.27 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.4.14 Released!
The PHP development team announces the immediate availability of PHP 8.4.14. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.14 please visit our , Windows source and binaries can be found on . The list of changes is recorded in the . downloads page windows.php.net/download/ ChangeLog
PHP 8.5.0 RC 3 available for testing
The PHP team is pleased to announce the third release candidate of PHP 8.5.0, RC 3. This continues the PHP 8.5 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.5.0 RC3, please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS…
Wed, October 22
Bun v1.3.1
Fixes 103 issues (addressing 172 👍). 2× faster bun build on macOS for symlink-heavy projects, source maps preserve legal comments, and --format=cjs now inlines import.meta; bun test adds global vi, --pass-with-no-tests, and --only-failures; .npmrc :email auth support, faster installs when no peer deps, selective hoisting for isolated installs (publicHoistPattern/hoistPattern), and fs/promises FileHandle.readLines(); numerous bundler/transpiler fixes (external sourcemaps in Bun.build({ compile:true }), --bytecode with import.meta, Windows react-jsxdev); reliability fixes across install/pm/pac…
GitLab Patch Release: 18.5.1, 18.4.3, 18.3.5
On October 22, 2025, we released versions 18.5.1, 18.4.3, 18.3.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Schedul…
Unbound 1.24.1 released
We are pleased to announce the release of version 1.24.1 of the Unbound recursive DNS resolver. This security release fixes CVE-2025-11411. Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data. Unbound is vulnerable for some of these cases that could lead to …
Next.js 16
Next.js 16 includes Cache Components, stable Turbopack, file system caching, React Compiler support, smarter routing, new caching APIs, and React 19.2 features.
Tue, October 21
My highlights from the new Deno Deploy
Highlights from the new version of Deno Deploy.
Sat, October 18
Streaming Global Live Events with Laravel. The Artisan of the Day Is Gustavo Karkow.
Gustavo Karkow’s Laravel journey spans public healthcare and streaming global live events, proving how great software can serve people at every scale.
Fri, October 17
Deno's Other Open Source Projects
Here’s a roundup of some of our popular open source libraries and how we use them in Deno.