Updated 10/26 - 09:01 UTC
Laravel Cloud
We have patched every running application on Laravel Cloud with the PHP and Node.js security releases, and deployments have resumed.
If any of your environments still use Node 20, please update their Node.js version. Node 20 is no longer available on Laravel Cloud, so any environment still using it can’t deploy until you update. We’ve emailed affected teams with a list of their environments.
Node 20 has reached end of life and won’t receive the latest security patch, or any patch after it. Keeping your applications safe comes first, so we’ve removed it from Laravel Cloud rather than letting anyone keep deploying on a version that can no longer be protected.
How to update:
Open your application in Laravel Cloud and select the environment.
Open the environment’s General settings page.
Under Runtime, choose any other Node.js version. We recommend 24, the current long-term support release, but every version we offer is patched.
Redeploy the environment.
Once the deployment finishes, your environment runs a supported, patched version of Node.js. For more detail, see the Runtimes docs.
Before you switch: most apps move from Node 20 to a newer version with no code changes. To be safe, make sure the engines field in your package.json (if you have one) allows the new version, and run your build locally or on a preview environment first.
Every other application on Laravel Cloud is already patched. We applied the PHP and Node.js security patches in place, so your applications stayed online, and no redeploy was needed. All new deployments use our updated base images, which include the patched versions of PHP and Node.js.
Laravel Forge
The PHP Foundation has recommended a temporary PHP setting change to block a newly reported security issue.
The risk is low for most apps. The issue only affects apps that switch PHP’s session.serialize_handler setting from another value to php at runtime, which Laravel doesn’t do. php is PHP’s default value, so seeing session.serialize_handler = php in your php.ini is expected and isn’t a problem on its own.
The PHP Foundation describes an attack as unlikely.
The fix is to turn off one setting until the next PHP release:
For new servers: we’ve changed Forge’s default PHP configuration, so new servers have this setting turned off automatically.
For existing servers: we haven’t changed this for you, because some apps rely on this setting being on. If your app doesn’t use PHP’s session upload progress feature, we recommend turning it off:
In your Forge dashboard, go to Server → Runtime → PHP → Versions.
Click the three-dot button next to the PHP version to show the edit options, then choose to edit the PHP configuration file (php.ini).
Set
session.upload_progress.enabled = Off.Save the file and restart PHP-FPM.
Do this for each PHP version installed on the server.
Most Laravel apps don’t use this feature, but check with your team before making changes.
Laravel Vapor
The patched PHP runtimes from the security release are now live on Vapor.
If your applications use a native runtime on PHP 8.2 or later, you will need to redeploy them to get on the patched secure PHP version. We previously aimed to auto-deploy the patch but now recommend customers redeploy their applications.
If your application uses a custom or Docker image runtime, you will need a new deployment, not just a redeploy.
If you’re running PHP 8.0, or 8.1 no patch is available. Upgrade to PHP 8.2 or later as soon as possible.
Laravel Envoyer
Envoyer is back online. Deployments are running as normal following yesterday's PHP security work.
Health checks are back online, and deployments are running as normal.
This post will be updated frequently. Check back for updates.