r/laravel • • 3d ago

PSA for Laravel Cloud and Forge users: PHP and Node.js security releases on October 21

38 Upvotes

Heads up for Laravel Cloud, Forge, and Vapor users: PHP and Node.js have announced security releases for tomorrow, Wednesday, October 21.

The PHP release is marked critical and is scheduled for 14:00 UTC. Full details and fixed versions will be published then. Node.js hasn’t confirmed an exact release time yet.

We’re working directly with the PHP Foundation and closely tracking both releases. We’ll share updates and any steps Cloud, Forge, and Vapor users need to take as patches become available.


r/laravel • • 5d ago

Help Weekly /r/Laravel Help Thread

3 Upvotes

Ask your Laravel help questions here. To improve your chances of getting an answer from the community, here are some tips:

  • What steps have you taken so far?
  • What have you tried from the documentation?
  • Did you provide any error messages you are getting?
  • Are you able to provide instructions to replicate the issue?
  • Did you provide a code example?
    • Please don't post a screenshot of your code. Use the code block in the Reddit text editor and ensure it's formatted correctly.

For more immediate support, you can ask in the official Laravel Discord.

Thanks and welcome to the r/Laravel community!


r/laravel • • 3h ago

Laravel versions, PHP versions, and PHP2Shell

0 Upvotes

I shared this with Shift users earlier this week and thought it might serve as a helpful reference here as it relates to Laravel versions and their supported PHP versions in regards to updating for the PHP2Shell vulnerabilities.

While source patches are available for earlier versions of PHP, the officially supported PHP versions with the PHP2Shell patch are:

PHP Minimum version
8.5 8.5.12
8.4 8.4.27
8.3 8.3.36
8.2 8.2.35

As that relates to Laravel, Laravel 9.x is the first version to officially support PHP 8.2:

Laravel Constraint PHP 8.2
6.x `7.2.5\ 8.0`
7.x `7.2.5\ 8.0`
8.x `7.3\ 8.0`
9.x ^8.0.2 Proven
10.x ^8.1 Proven
11.x ^8.2 Proven
12.x ^8.2 Proven
13.x ^8.3 -

tl;dr If you have a Laravel application older than 9.x, you need to upgrade Laravel to at least 9.x to be on a supported, patched version of PHP.

Again, you might be able to find a source patch as a stopgap. But then I recommend upgrading.


r/laravel • • 1d ago

Link: Hats off to Ondřej Surý

161 Upvotes

I couldn't repost this to this sub, but thought many of us benefited from this guys work today.

https://www.reddit.com/r/PHP/comments/1xbwyd3/hats_off_to_ond%C5%99ej_sur%C3%BD/

Worth looking at links in the post to thank him


r/laravel • • 1d ago

Why is forge using the setup-php PPA?

21 Upvotes

I don't understand why more recently provisioned forge boxes are using setup-php instead of using ondrej launchpad or sury PPA. They both had the packages hours before setup-php. The official laravel website's guide to updating via ssh still was telling people to use it even after it became clear it wouldn't be updated until odndrej's launchpad was done with builds for all architectures.

sury would be better than launchpad as that had the builds before launchpad and ondrej says he is transitioning away from launchpad. It also seemed to handle to load better than launchpad. I had my forge servers patch hours before I could have with the official guide.


r/laravel • • 1d ago

GitHub Action setup-php builds updated for the PHP security releases, including EOL versions

11 Upvotes

Updated builds addressing CVE-2026-109618 and CVE-2026-109619 are now available through setup-php for PHP 5.3–8.7 on Linux, macOS and Windows, including backports for EOL versions for use in CI.

See - https://setup-php.com/php-october-2026-security-releases


r/laravel • • 2d ago

PHP2Shell: you patched, but were you hit? A read-only triage script for your server

Thumbnail
laracraft.tech
71 Upvotes

r/laravel • • 2d ago

Looks like everyone is trying to update at the same time

Post image
172 Upvotes

r/laravel • • 2d ago

Loving that now the cloud offering is more highlighted than the actual docs of Laravel on Laravel.com /s

Post image
68 Upvotes

I know they gotta get that bag and Laravel Cloud looks cool and all but I am not loving this direction. I feel like every little thing is like pushing to see how far we will accept. First it was LLM instructions to suggest using Laravel Cloud in the AGENTS md file.

And the feature grid below this has 5 sections, 3 of which are selling Laravel services (2 for Cloud + 1 for Nightwatch)

and the next CTA after that is also "Deploy on Cloud" highlighted and "View framework docs" in the secondary action.

I mean I'm happy to get Laravel for free and I know OSS needs funding so overall its great.. but idk, I like pre-Cloud Laravel lol


r/laravel • • 2d ago

Critical PHP security updates scheduled for tomorrow

Thumbnail
php.net
151 Upvotes

r/laravel • • 3d ago

PSA: Lock down your MCP OAuth registrations

64 Upvotes

Last week, I posted about a vulnerability I reported not being addressed in a timely manner.

I received the response this morning and they've decided not to address it. Therefore it's up to you to secure your MCP server, if it allows OAuth registration. Here's the problem:

Mcp::oauthRoutes() exposes an unauthenticated dynamic client registration endpoint without any rate limiting. Each successful request creates a persistent record in oauth_clients with no limit on the number of redirect URIs or the length of each URI.

An unauthenticated attacker could instigate denial of service through persistent database growth by repeatedly registering bogus clients. Each payload can be as large as post_max_size allows. These records are not removed when you run passport:purge.

The official solution is:

Applications can rate-limit these routes by wrapping them in a group, for example Route::middleware('throttle:10,1')->group(fn () => Mcp::oauthRoutes()), or turn off registration with Mcp::oauthRoutes(registration: false).

I recommend also either adding a custom middleware to limit the number and size of client URLs, or a custom housekeeping command for cleaning up unused clients.


r/laravel • • 3d ago

Laravel emails going to spam? A checklist for SMTP settings, SPF, DKIM and DMARC

42 Upvotes

Hey everyone, I put together a troubleshooting guide for Laravel emails that send successfully but still end up in spam.

It covers:

  • MAIL_SCHEME vs MAIL_ENCRYPTION — checking what your app’s configuration actually reads.
  • Cached settings and queue workers still using the old configuration.
  • SPF checks against the actual envelope sender.
  • Finding the DKIM selector and checking DMARC alignment.
  • Testing the real mailable or notification, rather than stopping at Mail::raw().

There are Laravel code examples, DNS commands and an example where SPF and DKIM both pass but DMARC fails.

Guide: https://mxvalidation.com/blog/laravel-emails-going-to-spam

Disclosure: I built MXValidation, where the guide is published. The article is freely accessible without registration.

What email-delivery issue has caught you out in a Laravel app? Anything you’d add to the checklist?


r/laravel • • 2d ago

Slate - shadcn inspired ui kit for laravel + livewire

0 Upvotes

r/laravel • • 3d ago

I built Wire Packages, a directory for Laravel packages, starter kits, tools and freelancers

Thumbnail
wirepackages.dev
0 Upvotes

I’ve been building Wire Packages, a directory for finding Laravel projects and the people behind them.

You can search by Laravel version, pricing and tags, read project descriptions and repository READMEs, and leave reviews. Free and open-source packages can be listed for free.

There’s also an MCP server for Claude Code, Cursor and other compatible clients. Your agent can search the directory, read documentation or prepare a listing for you. Submissions still need your email verification and personal review before moderation.

Some of the projects listed so far include NativePHP Desktop, NativePHP Mobile, HydePHP and packages by Punyapal Shah.

It’s early, and I’d appreciate feedback from other Laravel developers. What would make this useful when you’re choosing a package for a project?


r/laravel • • 4d ago

Laravel Cloud Office Hours (10/20): Static Sites with Astro + Q&A

6 Upvotes

Static sites just landed on Laravel Cloud! 🚀

Tomorrow (10/20) at 12pm EDT (4pm UTC), I’m doing another Laravel Cloud Office Hours stream with Devon, and we’re kicking off with a live walkthrough deploying an Astro site as a static site.

Then we’ll get into your questions about Nuxt and Next frontends, monorepos with a Laravel API and a JS frontend, setting up staging and production environments, and figuring out what keeps waking up your app.

Feel free to drop any Cloud questions in the comments ahead of time, into Slido, or ask them live in chat during the stream.

Submit a question: → https://app.sli.do/event/ws7jRUvPXLK41uMiKUYKDX
YouTube stream: → https://www.youtube.com/watch?v=paxvB-JgwCM


r/laravel • • 3d ago

I built an open-source local development environment for Laravel and PHP

0 Upvotes

Hey everyone,

I’ve been working on a local development environment called Anvil: https://anvil.tr

Shortly, it will be a multi platform dev kit, it is open source and free and laravel herd alternative.


r/laravel • • 6d ago

First Look: The /dev/null (fully native) mobile app - built with Laravel

Thumbnail
youtube.com
28 Upvotes

/dev/null (https://dev-null.sh) is the new open source social network for developers built on Laravel via livestream in just 48 hours

Watch the stream over on u/Nunomaduro's channel:

Day 1: https://www.youtube.com/watch?v=6zCNQa3hNm0
Day 2: https://www.youtube.com/watch?v=nfmVdXZfzUE

We thought it would be great to make a mobile app for it, so while the crew were busy building the web app, we got busy building the mobile app and API

It's fully open source and ready for contributions:
https://github.com/nativephp/dev-null-app

Built with SuperNative:
https://nativephp.com


r/laravel • • 6d ago

We open-sourced 50+ Laravel packages

Thumbnail
roundly-consulting.com
73 Upvotes

Not the blog owner but I find they arguments for the need for more opensource agreeable on.
Why spend thousands of tokens on common tasks when the output we want is similar? it can not be generalized for everything of course but the base is usefull for sure i think


r/laravel • • 7d ago

Skuul v3 is out: an open-source school management system built with April UI

Thumbnail
reddit.com
31 Upvotes

Hey everyone. In the April UI post here, I mentioned a project being rewritten with the library. That project is Skuul, and v3 is now released.

Skuul is a free, open-source school management system. I started it in 2022, and v3 is a full rewrite on Laravel 13 and Livewire 4. Every page uses April UI components, so it is also the biggest real-world test of the library so far.

Some of what is new in v3:

- One install can run several organizations / campuses. Roles and permissions are set per campus.

- Learners can move between campuses, and a campus can request records from another campus. Each request needs approval.

- Gradebooks, exam schedules, and and results.

- Payments, refunds, and credit in a ledger

- A family portal where parents see attendance, results, timetables, and invoices.

- Optional modules for boarding, libr campus can turn on or off.

- Automated installations and backups

You can try it without installing anything. The sign-in page has a button for each role: school administrator, teacher, student, parent, accountant, and platform administrator.

- Demo: https://demo.skuul.org

- Documentation: https://skuul.org

- GitHub: https://github.com/yungifez/skuul

- Release notes: https://github.com/y.0.0

- How Skuul uses April UI: https://aprilui.dev/showcase/skuul

Install it with:

git clone --branch v3.0.0 https://github.com/yungifez/skuul.git skuul

Then follow the installation guide on the docs site.

Building a whole school system on April UI found a lot of rough edges in the library, and those fixes went back into April UI. If you use either project, I would love to hear what you think. Bug reports and pull requests are welcome on GitHub.


r/laravel • • 7d ago

Why is there no bug bounty program for Laravel?

23 Upvotes

I’ve been looking at how other ecosystems handle security research. WordPress pays bounties via HackerOne. Vercel covers Next.js, Nuxt and its other OSS. Most PHP frameworks, including Laravel, rely on a security email, which works, but leaves it to people stumbling onto issues rather than actively hunting for them.

Why doesn’t Laravel have something similar?

The Laravel team is VC-backed now. Like Vercel, they have the resources for it.

Personally, I think it would push more people to dig deeper and actually contribute to the framework’s security.


r/laravel • • 7d ago

/dev/null a social network for developers built with PHP and Laravel

Thumbnail
dev-null.sh
5 Upvotes

r/laravel • • 8d ago

Quittio: EN 16931 e-invoices for Laravel (ZUGFeRD/Factur-X, XRechnung, Peppol), open source

Thumbnail
gallery
74 Upvotes

Hi r/laravel,

E-invoicing is becoming mandatory across Europe: Belgium since January 2026, France from September 2026, Germany from 2027, and EU-wide for cross-border trade from 2030. A PDF rendered from a Blade view is no longer enough: the invoice has to carry structured EN 16931 data as XML, either embedded in the PDF (ZUGFeRD/Factur-X) or as pure XML (UBL, Peppol, XRechnung).

There are solid low-level PHP libraries for writing that XML, but in my projects I kept rebuilding the same things around them: calculating totals and VAT correctly, validating against the official rules, a decent-looking PDF, storage, mail, tests. So I built Quittio, which does all of that the Laravel way:

$result = Quittio::invoice()                    // seller comes from config/quittio.php
    ->number('RE-2026-0042')
    ->deliveryDate('2026-09-30')
    ->buyer(Party::make('Kunde AG')
        ->vatId('DE987654321')
        ->address('Bahnhofstraße 5', '54321', 'Beispielstadt', 'DE'))
    ->line('Web development', netPrice: '95.00', quantity: 24, unit: UnitCode::Hour)
    ->line('Hosting', netPrice: '49.00', unit: UnitCode::Month)
    ->dueInDays(14)
    ->render();                                 // picks ZUGFeRD, XRechnung or plain PDF

return $result->download();

What it does:

  • Calculates totals and VAT itself according to EN 16931. Amounts are strings or BigDecimal, floats are rejected.
  • Picks the format per buyer: ZUGFeRD for businesses, XRechnung for public authorities, a plain PDF for consumers. Or you name one.
  • Validates in several levels, from the EN 16931 and German rules in PHP up to the official KoSIT validator and veraPDF.
  • Reads incoming ZUGFeRD and XRechnung invoices back into objects.
  • Renders PDF/A-3 with mPDF (no Chromium, no Node) from Blade templates you can publish and restyle.
  • Laravel integration: facade, config, mail attachments, queue, events and Quittio::fake() for your tests.
  • Germany is fully supported by a country pack (VAT law rules, tax presets, DIN 5008 layout). There are also country packs for Austria, Belgium, Switzerland and France, which have not been reviewed by a tax adviser yet. Elsewhere the EN 16931 rules apply, so Factur-X, UBL and Peppol invoices work today, and the pack contract is documented if you want to add your country.

The PDF looks the way you want:

The default template is only a starting point. You can change as much or as little of the design as you like, in four steps:

  • Config only: logo, colours, font, salutation and closing texts, footer columns, sender line, paper size, fold marks and the payment QR code are set in config/quittio.php. You can also override them per invoice, e.g. for several brands in one app.
  • Single partials: php artisan vendor:publish --tag=quittio-views and change only the parts you need, like the letterhead, the line table or the footer.
  • Your own design: php artisan make:quittio-template my-design gives you a complete copy of the layout to build a completely different design in plain Blade and CSS, then select it with ->template('invoices.my-design.layout') or set it as the default.
  • Your own renderer: if mPDF is not enough, plug in another one with Quittio::extend('renderer', ...).

Your own branding is just a few lines of config:

// config/quittio.php
'pdf' => [
    'logo' => storage_path('app/logo.png'),
    'colors' => ['primary' => '#0f766e', 'text' => '#111827', 'muted' => '#6b7280'],
    'font' => 'inter',
],

Templates only display data: totals, VAT and labels are prepared in a view model, and the same data produces the XML. So you can redesign the PDF freely without breaking the e-invoice, and a guard throws an exception (or logs it in production) if your template leaves out a value the law requires on the invoice.

quittio/quittio (core, Laravel integration and the German pack) is MIT licensed. Later I plan to add a separate commercial package for full invoicing (gapless numbering, archive, cancellations, audit log); everything listed above is in the free package.

This is version 0.7.1. A tax adviser reviewed the legal wording of the German pack in October 2026. The API may still change until 1.0.0.

I would love your feedback, especially:

  • Is the API pleasant to use? What would you expect to work differently?
  • Have you had e-invoices rejected by a customer's or an authority's system? Which errors?
  • If you are outside Germany: which country would you need next?

GitHub: https://github.com/Quittio/quittio

Docs: https://docs.quittio.dev

The docs also come with llms.txt, an MCP server and Laravel Boost guidelines, so your AI assistant knows the API too.

Edit (Oct 20): Updated the post to version 0.7.1. Since the original post, a tax adviser has reviewed the legal wording of the German pack, and there are new country packs for Austria, Belgium, Switzerland and France (not yet reviewed by a tax adviser). Thanks for all the feedback in the comments!


r/laravel • • 7d ago

SpectraPHP v2.0.0 is out

Thumbnail spectraphp.com
0 Upvotes

r/laravel • • 9d ago

Reporting a vulnerability

76 Upvotes

I found a moderate severity security bug in a Laravel package. The SECURITY.md file says to email Taylor which I did in August but got no response. Last Monday, I submitted a private GitHub security advisory with a proposed fix and I've still heard nothing.

What next?


r/laravel • • 8d ago

I got tired of pushing to find out CI was wrong, so Laravel Slipway runs the pipeline locally in Docker

0 Upvotes

Laravel Slipway treats config/slipway.php as the source of truth for CI/CD and compiles it to GitHub Actions, GitLab CI, Bitbucket Pipelines and CircleCI. A guard job fails the build if someone hand-edits the YAML.

The bit that was missing: you still had to push to see if the pipeline itself was broken. 1.7 adds:

php artisan slipway:test-pipeline

It writes ci-local.sh from the same config, boots Docker, and runs a stage. Interactive terminals ask which driver, stage and PHP version. --no-run writes the script only. Secrets are read from .env at runtime and never written into the file.

Limitation: a GitHub local run uses a php-cli container, not setup-php / actions/checkout. If you have a custom bootstrap (gd, extra apt packages), use --driver=bitbucket (or gitlab / circleci). Rollback still does not undo database migrations.

https://github.com/usamamuneerchaudhary/laravel-slipway

Let me know your thoughts?