🐘 Laravel & PHP Developer | Maintainer of rector-laravel | 16y PHP • Practical tools for upgrades, refactoring & testing | https://xitter.cf/t.co/0MMcN8RLsv
United Kingdom
Joined April 2010
- Tweets13.2K
- Following961
- Followers2.2K
- Likes60.7K
Pinned Tweet
Okay, badge.laravel.cloud/ is now a thing.
Really happy with the @laravel cloud domain 😄
Still a few things I want to do, but I thought it would be better to get it out there instead of letting it gather dust.
ALT A Laravel badge preview tool is displayed, with input for package name and a generated compatibility badge on the left, featuring the Laravel logo.
Peter Fox retweeted
Still on PHP 5.x-8.1?
If you think this week is the only CVE 9+ incident, you'll be surprised.
Just to confirm. Yes, upgrading your apps in 2026 is definitely a skill issue.
No one who calls themselves a senior dev should be struggling with this. PHP has some of the best tooling to make upgrades easy.
This.
Don't forget about distribution channels etc as well
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
Yes, AI can do big upgrades for you. But enterprise businesses should consider having an upgrade plan.
Literally the most qualified people to do this are @rectorphp and @VotrubaT
If you'd like to avoid next #php2shell,
and still stuck on PHP 7 or 5,
hire us.
We'll upgrade you to safety👌
getrector.com/hire-team
I do hope this is a moment where companies consider they're often built on 'free' software, but the cost to maintain is hours upon hours of hard work.
I doubt that PHP and the distribution systems involved receive even 0.1% in donations of the revenue PHP apps around the world generate.
I just sponsored oerdnj. Go sponsor your open source dependencies!
github.com/sponsors/oerdnj?o…
Peter Fox retweeted
Good news everyone!
The absolute legends @ the Sury php mirror have backported the patch all the way back to 5.6
Peter Fox retweeted
‼️BREAKING: Security firm Calif appears to have a working exploit for the leaked PHP flaws, hours before the patch.
A briefly posted video credited to Calif shows it running commands on a WordPress 7.1.3 site on PHP 8.5.4. Kevin Beaumont says a screenshot from it is real.
A separate public PoC is also circulating, but its own author now says one of its attack chains is dead and code execution is unreliable.
Admins have two stopgaps until the fix lands at 14:00 UTC today.
Turning off session.upload_progress.enabled in php.ini disables the feature the leaked details point to. The only cost is upload progress bars.
Blocking every request with a multipart Content-Type at the web server goes further, but breaks file uploads.
Neither is official. Gina Peter Banyard, a PHP core developer at the PHP Foundation, says "the only mitigation is patching / upgrading PHP."
If you can afford to switch a server off for a day, she says, that might be the most sensible thing to do.
"I sadly know too much," she wrote.
I should add. There ways to reduce your surface area of attack from what info is out there. Patching is critical but my understanding is:
All issues relate to PHP's built-in session functionality. Laravel doesn't use this so turning off some features in the php.ini *might* help
The current attack vector is focused on multipart uploads and cookies related to PHP's built in Sessions.
You can use a load balancer/WAF to make automated attacks harder:
1. blocking PHP session cookies outright (if you don't use PHP sessions, Laravel doesn't for example)
2. only allowing multipart-forms etc. on endpoints that need it
The reasoning is that any attacker will now need to probe for endpoints that still allow and upload. Honestly, probably not going to do much if you're that determined.
🚩
Don't underestimate the affect of a patch like this. In a world with AI agents, nearly anyone can potentially download the new source code, RE the fix, build a payload and automate to target millions of preselected targets.
Peter Fox retweeted
Critical PHP vulnerabilities to be disclosed tomorrow: php.net/archive/2026.php.
We're working directly with the PHP Foundation to get patched PHP versions into our base images for Laravel Cloud, Forge, and Vapor ASAP.
You may need to redeploy your apps at that time to use these patched versions, but we're also working on the ability to silently patch applications without needing a redeployment.
All customers have been emailed and we will be providing further updates via email as the situation evolves.
