Vulnerabilities & updates
Sat, October 24Yesterday
Laravel TokenGuard authentication bypass through non-string API credentials
影響: composer:laravel/framework >= 13.0.0, < 13.29.0 → 13.29.0, composer:laravel/framework < 12.68.0 → 12.68.0 Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauth…
Laravel relationship inclusion can trigger unauthorized data destruction
影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0 A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…
Wed, October 21
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
Fri, October 16
MariaDB Foundation Newsletter – 15 October 2026
The first half of October belonged to the ecosystem. The MariaDB Ecosystem Hub passed 200 entries six months after launch, Laravel 13 gained native MariaDB Vector support through community contributors, and Frappe and Solanica joined the Foundation as Silver Sponsors. The Foundation’s testing framework learned PostgreSQL, reproduced a regression reported by Mark Callaghan and confirmed […] MariaDB Foundation Newsletter – 15 October 2026 appeared first on MariaDB.org
Thu, October 15
Add email to any Laravel Cloud environment with the Resend
Resend is now a first-party Laravel Cloud integration. Connect once, verify a domain, and attach email to an environment like any other resource.
Wed, October 7
Laravel 13 now supports MariaDB Vector natively
If your Laravel application runs on MariaDB, you can add semantic search to it without a second database, an external vector service or an extra package. Since Laravel 13.28, vector columns, vector indexes and similarity queries work on MariaDB out of the box. A large part of that work came from community contributors, including Mohamed […] Laravel 13 now supports MariaDB Vector natively appeared first on MariaDB.org
Fri, October 2
Laravel September product updates
Laravel Cloud added isolated preview environments and request metrics. The framework added per-tenant AI keys and semantic search. See what's new in September.
Thu, October 1
Migrating Pinkary from Laravel Forge to Laravel Cloud: An engineering playbook
Pinkary's move from Laravel Forge to Laravel Cloud exposed SQLite and MySQL differences, query assumptions, and local-storage coupling. Here is the code-backed migration playbook.
Mon, September 28
Preview environments and scale to zero: Better together
Give every pull request its own preview environment on Laravel Cloud. Share a link, test the full stack, and let idle previews scale to zero.
Wed, September 23
Introducing Laravel AI SDK v1.0
Laravel AI SDK v1.0 is here: one Laravel-native API for every provider, with conversation storage, streaming chat, agents, tool approvals, and Jev classification.
Fri, September 11
A better way to build MCP servers with Laravel
Every MCP tool loads on every request. Laravel MCP 1.0 fixes that with searchable tool catalogs: the same payload for 10 or 100 tools.
Thu, September 10
Why I think we should write our own PR descriptions
Agents can write your PR descriptions, but they shouldn't. Here's why writing them yourself makes you a better engineer and a better teammate.
Fri, September 4
Laravel August product updates
Here's everything that shipped in August.
Thu, September 3
Semantic memory or just Markdown?
Why Laravel Boost project rules use a generated Markdown index after we deleted semantic search.
Tue, September 1
Extracting AI rules from an existing codebase
How Laravel Boost uses an agent skill to find existing project conventions and record the useful ones as scoped rules.
Wed, August 26
Laravel Private Cloud is now HIPAA compliant
Laravel Private Cloud is now HIPAA compliant. See what the certification covers, what a BAA gets you, and how to secure PHI in your Laravel app.
Wed, August 19
Object storage migrations with Laravel's read-through filesystem
Migrate from S3 to R2 without downtime using Laravel 13's read-through filesystem driver. New writes land on the destination, legacy reads promote on access.
Mon, August 17
We built laracon.us/photos. We’re not developers.
We had hundreds of Laracon photos and no good way to share them. So two field marketers built laracon.us/photos with Claude, Laravel, and Laravel Cloud.
Fri, August 7
Managed Queues: Autoscaling Queue Workers on Laravel Cloud
Laravel Cloud’s managed queues autoscale workers on queue pressure, surface failed jobs in a built-in dashboard, and scale to zero when idle.
Wed, July 29
Everything we announced at Laracon US 2026
Every Laravel framework and Cloud announcement from Laracon US 2026, including Laravel LSP, Inertia DevTools, managed queues, and scale-to-zero.
Deploy Next.js and Nuxt apps on Laravel Cloud
Deploy your Next.js or Nuxt frontend alongside your Laravel app on Laravel Cloud: one platform, one deploy workflow, one bill.
Sat, July 25
AI coding agents pass tests. Can they write idiomatic Laravel?
AI coding agents can now pass every Laravel Boost eval. Next up: measuring idiomatic Laravel and correct code per token.
Wed, July 8
Laravel Cloud security defaults behind every deploy
Laravel Cloud handles WAF, runtime patching, audit logs, network isolation, and package vulnerability scans by default. See what runs in the background.
Thu, July 2
Laravel June product updates
You can now run Symfony apps on Laravel Cloud, managed Valkey caches and object storage are available in Forge, Bus::bulk() for efficient batch dispatch, and MCP client and server tooling across Laravel's AI stack. Here's everything that shipped in June.
Mon, June 29
Your Symfony app now runs on Laravel Cloud
Run your Symfony app on Laravel Cloud. Deploy faster, cut infrastructure costs, and spend your time building features instead of managing hosting.
Wed, June 17
Laravel Live Japan 2026 recap
A recap of the first Laravel Live Japan: two days in Tokyo, 550+ attendees from 40 countries, live AI translation, and a community that proved PHP has no borders.
Mon, June 15
How We Built Laravel Cloud’s Scale to Zero
Learn how the Laravel Cloud team built sub-500 ms scale to zero using checkpoint/restore, and how spending limits enforce a hard monthly ceiling for your apps.
Wed, June 10
Provision Laravel Cloud From the Stripe CLI
Laravel Cloud is now available in Stripe Projects. Provision your application, database, cache, and credentials directly from the Stripe CLI.
Laravel AI Agents Now Support MCP Servers
Connect any Laravel AI agent to an MCP server using the Laravel AI SDK and MCP. Supports bearer and OAuth auth, STDIO and HTTP transports, and built-in caching.
Sat, June 6
5 Tips to Save Money on Laravel Cloud
Five ways to reduce your Laravel Cloud bill: enable scale to zero, set a spending cap, use the usage page, switch to managed queues, and share resources.
Fri, June 5
Laravel May Product Updates
Full-stack scale-to-zero compute and managed queues on Laravel Cloud, @fonts and MySQL 8.4 in Forge. Here's everything that shipped in May.
Tue, June 2
Laracon US 2026
Information: Laracon US 2026 is the flagship Laravel conference, returning to the East Coast on July 28-29, 2026 at the SoWa Power Station in Boston, Massachusetts. Join Laravel and PHP developers from around the world for two days of world-class talks, hands-on learning, and community connection. Come ready to level up, leave ready to ship. July 28-29, 2026 SoWa Power Station, 550 Harrison Ave, Boston, MA, USA 14+ confirmed speakers, including Taylor Otwell and Nuno Maduro Additional events like: — July 27, 3:00 PM Dodgeball — July 27, 4:00 PM Larabelles Meetup — July 27, 8:00 PM Laraprom wi…
Mon, June 1
Your Laravel Cloud Stack Now Scales to Zero and Wakes 20x Faster
Laravel Cloud’s full stack now scales to zero and wakes in under 500 ms. A new $5 Starter plan and spending limits keep your bill in check.
Mon, May 25
Introducing Moat: A Security Review for Your GitHub Account
Moat scans your GitHub user, org, or repo with one command, and surfaces misconfigured security settings, including 2FA, pinned actions, branch protection, and more.
Thu, May 21
Migrating a Hybrid Architecture to Laravel Cloud: Top Q&A Questions Answered
Trybe shared how they migrated from Laravel Vapor to Laravel Cloud in a live webinar. Here are the top developer questions from the Q&A, answered.
Fri, May 15
Building AI Agents with Laravel: No Python Required
The Laravel AI SDK is the LangChain PHP alternative: agents, tools, memory, streaming, and multi-agent workflows, entirely in PHP. No Python required.
Introducing Laravel PAO: Cleaner Output for AI Agents
Laravel PAO formats PHPUnit, Pest, PHPStan, Rector, and Artisan output into structured JSON for AI agents automatically and without changing your terminal.
Building AI Agents with Laravel: No Python Required
The Laravel AI SDK is the LangChain PHP alternative: agents, tools, memory, streaming, and multi-agent workflows, entirely in PHP.
Fri, May 8
Laravel AI Integration: Build a Document Search Agent
Learn how to build a document search agent with the Laravel AI SDK. Upload files, generate vector embeddings, and stream answers to the browser in real time.
Sat, May 2
Laravel April Product Updates
Passkeys, debounceable jobs, MCP UI app support, mobile Cloud, and PHP 8.5 in Forge. Here's everything that shipped in April.
Fri, May 1
From Zero to Product: A Guide for Building a SaaS with Laravel
Build a production-ready SaaS the Artisan way with Laravel: Starter Kits, Socialite, Cashier, Pennant, and Laravel Cloud.
The Easiest and Fastest Way to Build MCP and Claude Apps
Laravel MCP Apps let your MCP tools return live, interactive HTML, all rendered inline inside Claude and VS Code Copilot. One command to scaffold.
Fri, April 24
Laravel Cloud Pre-Check: Is Your App Ready to Deploy?
Run the free Laravel Cloud Pre-Check to get an instant compatibility report for your app. Find out what to fix before you migrate in just a few minutes.
Thu, April 23
Why You Should Consider a Laravel Partner for Your Next Project
Learn more about the Laravel Partner program and why you should choose a Laravel Partner for your next project.
Fri, April 17
Deploy a Laravel MCP App to Production with Laravel Cloud
Build and deploy a Laravel MCP app on Laravel Cloud. We cover tool implementation, error handling, authentication, testing, and production monitoring.
Tue, April 14
How I Built an AI-Powered CRM with Laravel in a Week
How a senior freelance developer built a full Laravel MVP in under a week using Laravel Herd, Cloud, and the AI SDK to automate critical workflows.
Thu, April 2
Meet Maestro: How We Manage 21 Laravel Starter Kit Variants Without Losing Our Minds
Learn how Maestro solves the challenge of maintaining 21 Laravel starter kit variants across 8 repositories, using layered builds, priority-based sync, and a contributor workflow designed to scale.
Laravel March Product Updates
# Laravel March Product Updates March was a big month for product updates. Laravel 13 brings first-party AI tooling to the framework, Laravel Cloud now has a free trial with no credit card required,...
Sat, March 28
Laravel AI SDK: Building Production-Safe Database Tools for Agents
Build production-safe database tools with the Laravel AI SDK. Scope Eloquent queries by user, add vector search with SimilaritySearch, and prevent prompt injection.
Fri, March 27
Cutting Laravel Cloud Load Times by 60% with Nightwatch
How we cut environment dashboard response times from 907ms to 354ms with Laravel Nightwatch by fixing N+1 queries, redundant data, and deferring load.