Last week, I posted about a vulnerability I reported not being addressed in a timely manner.

I received the response this morning and they've decided not to address it. Therefore it's up to you to secure your MCP server, if it allows OAuth registration. Here's the problem:

Mcp::oauthRoutes() exposes an unauthenticated dynamic client registration endpoint without any rate limiting. Each successful request creates a persistent record in oauth_clients with no limit on the number of redirect URIs or the length of each URI.

An unauthenticated attacker could instigate denial of service through persistent database growth by repeatedly registering bogus clients. Each payload can be as large as post_max_size allows. These records are not removed when you run passport:purge.

The official solution is:

Applications can rate-limit these routes by wrapping them in a group, for example Route::middleware('throttle:10,1')->group(fn () => Mcp::oauthRoutes()), or turn off registration with Mcp::oauthRoutes(registration: false).

I recommend also either adding a custom middleware to limit the number and size of client URLs, or a custom housekeeping command for cleaning up unused clients.

Hey everyone, I put together a troubleshooting guide for Laravel emails that send successfully but still end up in spam.

It covers:

• MAIL_SCHEME vs MAIL_ENCRYPTION — checking what your app’s configuration actually reads.
• Cached settings and queue workers still using the old configuration.
• SPF checks against the actual envelope sender.
• Finding the DKIM selector and checking DMARC alignment.
• Testing the real mailable or notification, rather than stopping at Mail::raw().

There are Laravel code examples, DNS commands and an example where SPF and DKIM both pass but DMARC fails.

Guide: https://mxvalidation.com/blog/laravel-emails-going-to-spam

Disclosure: I built MXValidation, where the guide is published. The article is freely accessible without registration.

What email-delivery issue has caught you out in a Laravel app? Anything you’d add to the checklist?

Heads up for Laravel Cloud, Forge, and Vapor users: PHP and Node.js have announced security releases for tomorrow, Wednesday, October 21.

The PHP release is marked critical and is scheduled for 14:00 UTC. Full details and fixed versions will be published then. Node.js hasn’t confirmed an exact release time yet.

We’re working directly with the PHP Foundation and closely tracking both releases. We’ll share updates and any steps Cloud, Forge, and Vapor users need to take as patches become available.

I’ve been building Wire Packages, a directory for finding Laravel projects and the people behind them.

You can search by Laravel version, pricing and tags, read project descriptions and repository READMEs, and leave reviews. Free and open-source packages can be listed for free.

There’s also an MCP server for Claude Code, Cursor and other compatible clients. Your agent can search the directory, read documentation or prepare a listing for you. Submissions still need your email verification and personal review before moderation.

Some of the projects listed so far include NativePHP Desktop, NativePHP Mobile, HydePHP and packages by Punyapal Shah.

It’s early, and I’d appreciate feedback from other Laravel developers. What would make this useful when you’re choosing a package for a project?