PHP Critical Vulnerability: Laravel Patch Guide | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://www.msaied.com) - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [About](https://www.msaied.com#about) [ Contact](https://www.msaied.com#contact) Menu Menu ---- Close - [HomeStart here](https://www.msaied.com) - [ProjectsCase studies](https://www.msaied.com/projects) - [ArticlesEngineering notes](https://www.msaied.com/articles) - [CertificatesCredentials](https://www.msaied.com/certificates) - [AboutHow I work](https://www.msaied.com#about) - [ContactGet in touch](https://www.msaied.com#contact) [Start a conversation](https://www.msaied.com#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://www.msaied.com) 2. / 3. [Articles](https://www.msaied.com/articles) 4. / 5. [Laravel](https://www.msaied.com/articles?category=laravel) 6. / 7. PHP Critical Vulnerability Response: What Laravel Developers Must Do Now [Laravel](https://www.msaied.com/articles?category=laravel) [PHP](https://www.msaied.com/articles?category=php) PHP Critical Vulnerability Response: What Laravel Developers Must Do Now ========================================================================= Two critical PHP security vulnerabilities were disclosed on October 21, 2026. Here is exactly what you need to do to patch your Laravel Cloud, Forge, Vapor, and Envoyer environments right now. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://www.msaied.com#person) Published 21 Oct 2026 · Updated 24 Oct 2026 · 3 min read ShareCopy linkCopied ![PHP Critical Vulnerability Response: What Laravel Developers Must Do Now](https://cdn.msaied.com/803/29aa0b15365e1c360240c5160e8fa81f.png) On this page +1. [Two Critical PHP Vulnerabilities Disclosed — Act Now](#two-critical-php-vulnerabilities-disclosed-act-now) 2. [Laravel Cloud — Already Patched, No Action Required](#laravel-cloud-already-patched-no-action-required) 3. [Laravel Forge — Manual Update Required](#laravel-forge-manual-update-required) 4. [Steps to patch your Forge servers](#steps-to-patch-your-forge-servers) 5. [Ubuntu 20.04 and older — critical warning](#ubuntu-2004-and-older-critical-warning) 6. [Laravel Vapor — Redeploy Required](#laravel-vapor-redeploy-required) 7. [Laravel Envoyer — Back Online](#laravel-envoyer-back-online) 8. [Key Takeaways](#key-takeaways) Two Critical PHP Vulnerabilities Disclosed — Act Now ---------------------------------------------------- On October 21, 2026, two critical security vulnerabilities were disclosed and patched in PHP. These flaws affect **every PHP application on the web**, making this one of the most serious security events in recent PHP history. The Laravel team responded quickly across all its hosted products. Below is a consolidated guide covering what happened and what action you need to take on each platform. --- Laravel Cloud — Already Patched, No Action Required --------------------------------------------------- If you host on Laravel Cloud, the good news is that **the Laravel team applied patches in place** — your applications stayed online with zero downtime and no redeploy was needed. Depending on the PHP version your application targets, it now runs one of the following patched releases: - PHP 8.5.12 - PHP 8.4.27 - PHP 8.3.36 - PHP 8.2.35 All new deployments use updated base images that include both the patched PHP and Node.js security releases. --- Laravel Forge — Manual Update Required -------------------------------------- Patched PHP versions are available for **every supported PHP version on Forge, from PHP 5.6 through 8.5**. ### Steps to patch your Forge servers 1. Open your server in the Forge dashboard. 2. Click **"Update PHP"**. 3. Repeat for every server you manage. > Due to high demand, updates may take longer than usual. If the dashboard update fails, connect via SSH and follow the [official step-by-step guide](https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026). To confirm your server is running a patched version: ```bash php -v ``` ### Ubuntu 20.04 and older — critical warning If your server runs **Ubuntu 20.04 or an older release, you cannot update PHP** through the normal process. You must: 1. Provision a new server on a supported Ubuntu version. 2. Migrate your sites to the new server. 3. Power down the old server until migration is complete. Also remember: **Node.js updates on Forge are not automatic.** Update Node.js manually on each server. --- Laravel Vapor — Redeploy Required --------------------------------- Patched PHP runtimes are live on Vapor, but your application must be redeployed to use them. | Runtime type | Action needed | |---|---| | Native runtime (PHP 8.2+) | Redeploy your application | | Custom or Docker image runtime | Full new deployment (not just redeploy) | | PHP 8.0 or 8.1 | No patch available — upgrade to PHP 8.2+ immediately | If you are still on PHP 8.0 or 8.1, treat this as an urgent upgrade. No security patch exists for those versions. --- Laravel Envoyer — Back Online ----------------------------- Envoyer was temporarily affected during the security response window but is now **fully operational**. Health checks and deployments are running as normal. --- Key Takeaways ------------- - **Laravel Cloud users**: no action needed — patches were applied automatically. - **Forge users**: click "Update PHP" in the dashboard for every server, or update via SSH. - **Forge on Ubuntu 20.04 or older**: migrate to a new server immediately and power down the old one. - **Vapor users on native runtimes**: redeploy your applications now. - **Vapor users on Docker/custom runtimes**: perform a full new deployment. - **Vapor users on PHP 8.0/8.1**: upgrade to PHP 8.2 or later — no patch is available for those versions. - **Node.js**: update it manually on any Forge server that uses it. --- Source: [PHP critical vulnerability response updates — Laravel Blog](https://laravel.com/blog/php-critical-vulnerability-response-updates) - [PHP Security](https://www.msaied.com/articles?search=PHP%20Security) - [Laravel](https://www.msaied.com/articles?search=Laravel) - [Vulnerability Patch](https://www.msaied.com/articles?search=Vulnerability%20Patch) - [Laravel Forge](https://www.msaied.com/articles?search=Laravel%20Forge) - [Laravel Vapor](https://www.msaied.com/articles?search=Laravel%20Vapor) - [Laravel Cloud](https://www.msaied.com/articles?search=Laravel%20Cloud) Frequently asked questions --------------------------- Do I need to redeploy my Laravel Cloud application after the October 2026 PHP vulnerability patch?No. The Laravel team patched all running applications on Laravel Cloud in place, so your application stayed online without any redeploy. It now runs the patched PHP version automatically. My Forge server runs Ubuntu 20.04. How do I apply the PHP security patch?You cannot update PHP on Ubuntu 20.04 or older through the normal Forge process. You must provision a new server on a supported Ubuntu version, migrate your sites to it, and power down the old server until the migration is complete. I use Laravel Vapor with PHP 8.1. Is there a patch available for the October 2026 vulnerability?No patch is available for PHP 8.0 or 8.1 on Vapor. You should upgrade your application to PHP 8.2 or later as soon as possible to receive the patched runtime. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://www.msaied.com#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://www.msaied.com#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articleFilament v5.10.3 Released: Bug Fixes, Performance Improvements & i18n Updates](https://www.msaied.com/articles/filament-v5103-released-bug-fixes-performance-improvements-i18n-updates) [Next articleScreenshot: Capture Images and PDFs from Blade Views and URLs in Laravel](https://www.msaied.com/articles/screenshot-capture-images-and-pdfs-from-blade-views-and-urls-in-laravel) On this page ------------- 1. [Two Critical PHP Vulnerabilities Disclosed — Act Now](#two-critical-php-vulnerabilities-disclosed-act-now) 2. [Laravel Cloud — Already Patched, No Action Required](#laravel-cloud-already-patched-no-action-required) 3. [Laravel Forge — Manual Update Required](#laravel-forge-manual-update-required) 4. [Steps to patch your Forge servers](#steps-to-patch-your-forge-servers) 5. [Ubuntu 20.04 and older — critical warning](#ubuntu-2004-and-older-critical-warning) 6. [Laravel Vapor — Redeploy Required](#laravel-vapor-redeploy-required) 7. [Laravel Envoyer — Back Online](#laravel-envoyer-back-online) 8. [Key Takeaways](#key-takeaways) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://www.msaied.com#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/802/4b381a7cf7b496975aa9775d2454494f.png) Laravel · 4 min read### Screenshot: Capture Images and PDFs from Blade Views and URLs in Laravel 21 Oct 2026 ](https://www.msaied.com/articles/screenshot-capture-images-and-pdfs-from-blade-views-and-urls-in-laravel) [ ![](https://cdn.msaied.com/800/c7c4a69453f0653a60c996daa58b2096.png) Laravel · 4 min read### Filament v5.10.3 Released: Bug Fixes, Performance Improvements & i18n Updates 20 Oct 2026 ](https://www.msaied.com/articles/filament-v5103-released-bug-fixes-performance-improvements-i18n-updates) [ ![](https://cdn.msaied.com/801/da371310d5555269173fd04af50fde4b.png) Laravel · 4 min read### Filament v4.15.3 Released: Bug Fixes, Performance Improvements & i18n Updates 20 Oct 2026 ](https://www.msaied.com/articles/filament-v4153-released-bug-fixes-performance-improvements-i18n-updates) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://www.msaied.com#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://www.msaied.com) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://www.msaied.com/sitemap.xml)