Digest · Week 43
Week 43: Critical PHP release and Laravel auth bypass
· 13 items · 2 min read
- Act now
- 3
- Updates
- 9
- End of life
- 1
Patch PHP first. The critical release covers every site on PHP 8.2 to 8.5. Next, update laravel/framework, where the worst advisory is a TokenGuard authentication bypass, then Node.js. PostgreSQL 14 loses security support on 12 Nov 2026, so plan those upgrades now.
Act now
3Update these today if the package ships to visitors.
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are out with critical security fixes for 2 vulnerabilities.
Every site on PHP 8.2 to 8.5 should move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. The release has two critical fixes, so patch this first.
older patch releases →8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
2 advisories, the worst: Laravel TokenGuard authentication bypass through non-string API credentials
Laravel sites should update to 12.68.0 or 13.29.0. The worst of two advisories is a TokenGuard authentication bypass through non-string API credentials.
2 ranges →12.68.0 · 13.29.0
Node.js 22.23.4, 24.22.1 and 26.12.1 are out with high security fixes for 15 vulnerabilities.
Update Node.js to 22.23.4, 24.22.1 or 26.12.1 wherever you run it. The release fixes 15 vulnerabilities rated high.
older patch releases →22.23.4 · 24.22.1 · 26.12.1
Updates
9Moderate or low, or build-time only. Fine for your next round.
6 advisories, the worst: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows · build-time only
Projects on Vite 8.3 releases before 8.3.3 should update to 8.3.3. There are six advisories, all build-time only. The worst affects Windows.
≥ 8.3.0, < 8.3.3 →8.3.3
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Sites on Livewire 4.3.0 or later, below 4.4.8, should update to 4.4.8. It fixes an authorisation bypass in #[Authorize].
≥ 4.3.0, < 4.4.8 →4.4.8
Debian and Ubuntu patched ca-certificates for 9 releases. Run your package updates on servers you manage.
Run package updates on the Debian and Ubuntu servers you manage. The ca-certificates patch covers nine releases.
Ubuntu patched curl (18 CVEs) for 1 release. Run your package updates on servers you manage.
Run package updates on the Ubuntu servers you manage. The curl patch fixes 18 CVEs for one release.
patched
Ubuntu patched ghostscript (2 CVEs) for 7 releases. Run your package updates on servers you manage.
Run package updates on the Ubuntu servers you manage. The ghostscript patch fixes two CVEs across seven releases.
patched
Debian patched nginx (5 CVEs) for 1 release. Run your package updates on servers you manage.
Run package updates on the Debian servers you manage. The nginx patch fixes five CVEs for one release.
patched
Ubuntu patched openssh (9 CVEs) for 1 release. Run your package updates on servers you manage.
Run package updates on the Ubuntu servers you manage. The openssh patch fixes nine CVEs for one release.
patched
Ubuntu and Debian patched php (16 CVEs) for 17 releases. Run your package updates on servers you manage.
Servers using Ubuntu or Debian PHP packages need package updates. The patch fixes 16 CVEs across 17 releases.
Ubuntu patched sudo-rs for 1 release. Run your package updates on servers you manage.
Run package updates on the Ubuntu servers you manage. The sudo-rs patch covers one release.
patched
End of life
1Runtimes and databases near or past the end of security support.
PostgreSQL 14 stops getting security fixes on 12 Nov 2026, in 20 days. The newest supported is 18.
PostgreSQL 14 stops getting security fixes on 12 Nov 2026. Plan upgrades to a supported version. The newest is 18.
14 →18
Get this every Friday
One short email: the advisories and end-of-life dates that matter for agency sites. No other mail.
Fridays · unsubscribe in one click · stored in the UK