On November 4, 2026, Laravel published its post-mortem of the response to the PHP and Node.js security releases of October 21. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. The report shows that the same advisory required different work in each Laravel product, and who did that work depended on the product the customer had bought.
Cloud applied the fix; Forge and Vapor handed the task back
On Laravel Cloud, the company swapped the PHP binary inside running applications, with no customer redeploy. The fix reached 100% of regions at 18:05 UTC on October 21. New deployments were paused from 13:54 to 17:33 UTC. According to Laravel, Cloud customers did not need to do anything, and the company found no evidence that any customer was exploited.
On Forge, the customer updates PHP on each server. The Forge knowledge base warns that the product's automatic security updates do not include PHP: it comes from a separate package repository, and Ubuntu's unattended upgrades only apply Ubuntu's own security repository. On the day, upgrade jobs reached about ten times the normal volume, the queue left deployments stuck, and about 4,800 deployments were cancelled between 19:30 and 21:27 UTC. Those customers had to deploy again.
On Vapor, Laravel published new runtimes, and each customer had to redeploy to pick them up. The guidance changed during the incident: the company first said it would redeploy for customers, and at 19:25 UTC it asked each customer to redeploy their own application. Envoyer was offline from 13:52 to 22:58 UTC while its own servers were upgraded.
Who needs to check now
Anyone running Forge, Vapor or their own servers with PHP who has not yet verified the installed version. The post-mortem itself admits Laravel had "no reliable record" of which software version each application ran; if the vendor did not have one, it is fair to ask whether your team does.
For Cloud customers, Laravel has already applied the PHP fix. For teams that hire an agency or vendor, the useful question is who is responsible for updating the runtime, and that should be written into the maintenance contract. This is the part of a platform's cost that tends to show up only during an incident, as I discussed in Tool cost includes the work to replace it.
What to do, and by when
The flaws have been public since October 21, so the deadline has passed. The sequence Forge recommends works for any Ubuntu server with PHP installed from these packages:
- Update every PHP version installed on the server, including those no site uses.
- Restart long-running processes. Queue workers, Horizon, Octane and Reverb keep running the old PHP until they are restarted, even after PHP-FPM comes back on the new version.
- Check with
php -vandphp-fpm -vthat the fixed version is active.
For PHP 8.1 and earlier, which no longer get official releases, the package maintainer published fixes as new package revisions. The version number stays the same, and only the package revision (dpkg -l) shows whether the fix is in. It is a stopgap; Forge recommends moving to a supported version.
On Vapor, redeploy to use the new runtime and check whether the application still uses the al2 runtime, which Laravel has marked as unsupported and about which it is contacting customers. PHP 8.2 reaching end of life on December 31, 2026, per php.net, also belongs in the plan.
If the update cannot go out today, the PHP advisory lists partial mitigations, such as session.upload_progress.enabled = 0 in server configuration, and says none of them make an installation safe.
What is still open
Laravel says it is reviewing its redeployment policy so there is a written answer for what happens when it can neither patch nor automatically redeploy an application. That policy has not been published yet, nor has the promised follow-up on making the response routine. On the PHP side, an October 23 advisory recommends disabling session upload progress until the next bugfix release, and the full details of CVE-2026-115560 will only come with that release.
If your company is weighing something similar, reach me on LinkedIn or WhatsApp.
