脆弱性・アップデート
10月21日(水)昨日
Critical PHP Security Release
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]
PHP critical vulnerability response updates
At 13:40 UTC two critical security vulnerabilities were disclosed and patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Action may be required, read below.
Security advisory: Critical remote code execution vulnerabilities, update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…
PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.5.12 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.4.27 Released!
The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.4.27 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.36 Released!
The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory For source downloads of PHP 8.3.36 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
Weekly Report: Drupal coreおよび複数のモジュールに脆弱性
Drupal coreおよび複数のモジュールに脆弱性
PHP 8.2.35 Released!
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the for details. security advisory PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version. For source downloads of PHP 8.2.35 pleas…
PHP 8.2.35 released!
There is a new PHP release in town!
PHP 8.3.36 released!
There is a new PHP release in town!
PHP 8.4.27 released!
There is a new PHP release in town!
PHP 8.5.12 released!
There is a new PHP release in town!
Cachet has Stored XSS in Incident Component
影響: composer:cachethq/cachet <= 2.4.1 Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. While tags appear to be filtered, event-based payloads are not blocked. Affected endpoint: /dashbo…
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an . upcoming security release It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild. Full details, affected versions, and the fixed versions will be published with the release. Thank you for helping us keep…
10月16日(金)
MariaDB Foundation Newsletter – 15 October 2026
The first half of October belonged to the ecosystem. The MariaDB Ecosystem Hub passed 200 entries six months after launch, Laravel 13 gained native MariaDB Vector support through community contributors, and Frappe and Solanica joined the Foundation as Silver Sponsors. The Foundation’s testing framework learned PostgreSQL, reproduced a regression reported by Mark Callaghan and confirmed […] MariaDB Foundation Newsletter – 15 October 2026 appeared first on MariaDB.org
10月15日(木)
Add email to any Laravel Cloud environment with the Resend
Resend is now a first-party Laravel Cloud integration. Connect once, verify a domain, and attach email to an environment like any other resource.
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to e…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities…
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit p…
10月9日(金)
PHP 8.6.0 RC3 available for testing
The PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC3. This continues the PHP 8.6 release cycle, whose rough outline is specified in the . PHP Wiki Source downloads of PHP 8.6.0 RC3 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NE…
10月7日(水)
Laravel 13 now supports MariaDB Vector natively
If your Laravel application runs on MariaDB, you can add semantic search to it without a second database, an external vector service or an extra package. Since Laravel 13.28, vector columns, vector indexes and similarity queries work on MariaDB out of the box. A large part of that work came from community contributors, including Mohamed […] Laravel 13 now supports MariaDB Vector natively appeared first on MariaDB.org
WordPress 7.1.3 Maintenance and Security Release
This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background […]
10月2日(金)
Laravel September product updates
Laravel Cloud added isolated preview environments and request metrics. The framework added per-tenant AI keys and semantic search. See what's new in September.
10月1日(木)
Migrating Pinkary from Laravel Forge to Laravel Cloud: An engineering playbook
Pinkary's move from Laravel Forge to Laravel Cloud exposed SQLite and MySQL differences, query assumptions, and local-storage coupling. Here is the code-backed migration playbook.
9月28日(月)
Preview environments and scale to zero: Better together
Give every pull request its own preview environment on Laravel Cloud. Share a link, test the full stack, and let idle previews scale to zero.
9月25日(金)
[悪用確認] CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability
WordPress Core WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-09-28)
PHP 8.4.26 Released!
The PHP development team announces the immediate availability of PHP 8.4.26. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.26 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
9月24日(木)
PHP 8.2.34 Released!
The PHP development team announces the immediate availability of PHP 8.2.34. This is a security release. All PHP 8.2 users are encouraged to upgrade to this version. For source downloads of PHP 8.2.34 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.5.11 Released!
The PHP development team announces the immediate availability of PHP 8.5.11. This is a security release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.11 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.3.35 Released!
The PHP development team announces the immediate availability of PHP 8.3.35. This is a security release. All PHP 8.3 users are encouraged to upgrade to this version. For source downloads of PHP 8.3.35 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.6.0 RC2 available for testing
The PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC2. It is not a typo: a mistake was made while packaging RC1, so RC2 was released instead. For a full explanation, please see this . This continues the PHP 8.6 release cycle, whose rough outline is specified in the . blog post PHP Wiki Source downloads of PHP 8.6.0 RC2 are available on the . download page Please carefully test this version and report any issues found in the . GitHub Issues Please DO NOT use this version in production, it is an early test version. For more information on the new features and other c…
9月23日(水)
Introducing Laravel AI SDK v1.0
Laravel AI SDK v1.0 is here: one Laravel-native API for every provider, with conversation storage, streaming chat, agents, tool approvals, and Jev classification.
9月22日(火)
WordPress 7.1.2 Release
This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, […]
9月18日(金)
WordPress 7.1.1 Maintenance and Security Release
This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update […]
9月17日(木)
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013
Project: Drupal core Project machine name: drupal Date: 2026-September-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal . Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor th…
9月11日(金)
A better way to build MCP servers with Laravel
Every MCP tool loads on every request. Laravel MCP 1.0 fixes that with searchable tool catalogs: the same payload for 10 or 100 tools.
Dutch PHP Conference 2027
🚀 Dutch PHP Conference 2027 is coming! 🚀 We’re thrilled to announce that the 21st edition of the Dutch PHP Conference will take place from March 16 to March 19, 2027 in Amsterdam! 🗓️ 🎤 Call for Papers is now OPEN! 🎤 Got insights, skills, or experience to share? Submit your talk ideas before the deadline on December 18th! We’re looking for both technical and non-technical sessions that will inspire and engage our community. 🎟️ Early Bird Tickets Available Now! 🎟️ This year, we're excited to split our conference into an action-packed 2-day format! A standard DPC conference day ticket now…
PHP 8.6.0 Beta 3 is available for testing
The PHP team is pleased to announce the third beta release of PHP 8.6.0, Beta 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Beta 3 please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS…
9月10日(木)
Why I think we should write our own PR descriptions
Agents can write your PR descriptions, but they shouldn't. Here's why writing them yourself makes you a better engineer and a better teammate.
PHPBenelux Conference 2027, Antwerp Belgium
PHPBenelux is back! After 11 successful editions, the leading PHP conference in Belgium, the Netherlands and Luxembourg is back for a one-day event on Saturday January 23 2027. Join us in Antwerp for a new chapter of technical excellence, community, and connection. , and visit for more information about the conference. Buy your tickets here https://conference.phpbenelux.eu
PHPBenelux Conference 2027, Antwerp Belgium
The is back and now it's your turn to take the stage! Whether you're a developer, architect, engineering lead, DevOps engineer, or open-source contributor, we'd love to hear your story. Join a long tradition of knowledge sharing, inspire fellow developers, and help shape the next chapter of the PHP ecosystem. Share your unique perspective, PHPBenelux Conference submit your proposal today!
9月4日(金)
Laravel August product updates
Here's everything that shipped in August.
9月3日(木)
Semantic memory or just Markdown?
Why Laravel Boost project rules use a generated Markdown index after we deleted semantic search.
9月2日(水)
PHP Conference Ehime 2026
PHP Conference Ehime will be held for the first time on October 3, 2026 (JST), at Ehime University Johoku Campus in Matsuyama City, Ehime Prefecture, Japan.🍊 The theme of the conference is "技術愛とコミュニティ愛と愛媛愛と": love for technology, love for the community, and love for Ehime. Join us in this castle and hot-spring town of Shikoku, and connect with PHP developers from all over Japan. Tickets are , and further information is available on the and on . on sale now event page X(Twitter)
9月1日(火)
Extracting AI rules from an existing codebase
How Laravel Boost uses an agent skill to find existing project conventions and record the useful ones as scoped rules.
8月31日(月)
Forum PHP 2026 - Paris (France)
Join the biggest PHP event organized by the French PHP user group, organized for the third time in Disneyland Paris, at the Hotel New York - The Art of Marvel! During two days, on October 8th and 9th, enjoy the company of our friendly audience, share your knowledge with +700 attendees, meet the companies who use PHP every day, in a environment that will bring even more magic to the language. Date: October 8 & 9 Check out more details at Afup.org
8月28日(金)
PHP 8.5.10 Released!
The PHP development team announces the immediate availability of PHP 8.5.10. This is a bug fix release. All PHP 8.5 users are encouraged to upgrade to this version. For source downloads of PHP 8.5.10 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
8月27日(木)
PHP 8.4.25 Released!
The PHP development team announces the immediate availability of PHP 8.4.25. This is a bug fix release. All PHP 8.4 users are encouraged to upgrade to this version. For source downloads of PHP 8.4.25 please visit our , Windows source and binaries can also be found . The list of changes is recorded in the . downloads page there ChangeLog
PHP 8.6.0 Beta 2 available for testing
The PHP team is pleased to announce a new beta release of PHP 8.6.0, Beta 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the . PHP Wiki For source downloads of PHP 8.6.0 Beta 2 please visit the . download page Please carefully test this version and report any issues found . on GitHub Please DO NOT use this version in production, it is an early test version. For more information on the new features and other changes, you can read the file, or the file for a complete list of upgrading notes. These files can also be found in the release archive. NEWS UPGR…