Laravel PHP & Node.js Vulnerability Patch Post Mortem | Mohamed Said [Skip to content](#main) [ ![](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed SaidLaravel Backend Engineer ](https://www.msaied.com) - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [About](https://www.msaied.com#about) [ Contact](https://www.msaied.com#contact) Menu Menu ---- Close - [HomeStart here](https://www.msaied.com) - [ProjectsCase studies](https://www.msaied.com/projects) - [ArticlesEngineering notes](https://www.msaied.com/articles) - [CertificatesCredentials](https://www.msaied.com/certificates) - [AboutHow I work](https://www.msaied.com#about) - [ContactGet in touch](https://www.msaied.com#contact) [Start a conversation](https://www.msaied.com#contact) [WhatsApp](https://wa.me/201094619204) [Email](mailto:hello@msaied.com) 1. [Home](https://www.msaied.com) 2. / 3. [Articles](https://www.msaied.com/articles) 4. / 5. [Laravel](https://www.msaied.com/articles?category=laravel) 6. / 7. Post Mortem: How Laravel Patched PHP and Node.js Vulnerabilities Across Its Entire Fleet [Laravel](https://www.msaied.com/articles?category=laravel) [PHP](https://www.msaied.com/articles?category=php) Post Mortem: How Laravel Patched PHP and Node.js Vulnerabilities Across Its Entire Fleet ========================================================================================= On 21 October 2026, Laravel patched critical PHP and Node.js vulnerabilities across every Cloud application in under 5 hours using live in-place patching — no customer redeployment required. Here's exactly how they did it. ![](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) [Mohamed Said](https://www.msaied.com#person) Published 4 Nov 2026 · Updated 6 Nov 2026 · 4 min read ShareCopy linkCopied ![Post Mortem: How Laravel Patched PHP and Node.js Vulnerabilities Across Its Entire Fleet](https://cdn.msaied.com/817/1f6e0273ce6e6ecf37ad8c7616c60135.png) On this page +1. [What Happened](#what-happened) 2. [Why the Normal Playbook Did Not Work](#why-the-normal-playbook-did-not-work) 3. [Adding a Firewall Layer First](#adding-a-firewall-layer-first) 4. [Building PHP Independently](#building-php-independently) 5. [Live Patching Running Workloads on Kubernetes](#live-patching-running-workloads-on-kubernetes) 6. [What Broke on Forge, Envoyer, and Vapor](#what-broke-on-forge-envoyer-and-vapor) 7. [Key Takeaways](#key-takeaways) 8. [What Laravel Is Changing](#what-laravel-is-changing) What Happened ------------- On the evening of 20 October 2026, the Laravel team received a pre-announcement that PHP and Node.js were about to ship security fixes for critical vulnerabilities. The public releases landed at 13:38 UTC on 21 October. PHP fixed two critical remote code execution (RCE) vulnerabilities; Node.js fixed ten, including a Brotli decoder flaw that also allowed RCE. The team had under 24 hours to patch every managed workload before details became public enough for active exploitation to begin. Why the Normal Playbook Did Not Work ------------------------------------ The standard response to a CVE is to update base images and ask customers to redeploy. That approach has two problems at scale: - A fleet-wide rebuild takes many hours during a critical window. - Customer deploy commands can include database migrations and file changes that are not safe to trigger on someone else's behalf. The severity of these vulnerabilities demanded a second playbook: patch every workload without requiring a customer redeploy. Adding a Firewall Layer First ----------------------------- Before the PHP patch was even public, the team enabled Cloudflare's managed firewall ruleset across all Cloud domains at 08:55 UTC on 21 October, including rules that flag RCE and anomalous code execution patterns in incoming requests. Forge and dedicated zones followed by 10:24 UTC. The firewall reduced exposure but did not replace the patch — it is now a permanent layer. Building PHP Independently -------------------------- Rather than waiting on Docker Hub (which publishes patched images hours after a release), the team used Docker Hub's open-source build process to compile patched PHP themselves. Their own image was ready at 14:24 UTC — ahead of Docker Hub's patched images — and was used for the rollout. Live Patching Running Workloads on Kubernetes --------------------------------------------- Laravel Cloud runs on Kubernetes. The team updated their custom app operator to drop patched PHP binaries directly into each running workload at startup, then restart the pod. Because Kubernetes handles restarts gracefully, customer applications saw no downtime. A built-in pacer prevented a thundering-herd restart. The team accelerated it 5× — roughly 35 minutes of pacing instead of three hours — without removing it entirely, to protect downstream billing and state systems. The mechanism was canaried in two low-density regions (Canada and Tokyo) at 11:17 UTC, before the PHP release was even public. The main rollout began at 14:31 UTC and completed at 18:05 UTC. **Every Cloud application was patched in under 5 hours. No customer action was required.** What Broke on Forge, Envoyer, and Vapor --------------------------------------- The three other products had harder days: - **Forge** saw roughly 10× normal upgrade job volume. Jobs failed against flaky upstream package repositories and shared a queue with deployments, starving them. About 4,800 deployments were eventually cancelled. - **Envoyer** ran end-of-life software and had to be taken fully offline for server upgrades from 13:52 UTC until 22:58 UTC. - **Vapor** required new runtimes and customer redeployments to pick them up. A premature recovery announcement on Forge at ~17:45 UTC — before the queue had truly cleared — added to customer confusion. Key Takeaways ------------- - **In-place patching via a Kubernetes operator** is now a standard tool in Laravel's incident playbook. - **Building your own runtime images** removes dependency on third-party publishing schedules during a crisis. - **Firewall rules are a complement, not a substitute**, for patching — but they buy time. - **Separate deployment queues** from maintenance job queues to prevent surge starvation (Forge now does this). - **Soak periods before recovery announcements** prevent premature all-clear messages. - **End-of-life software creates forced downtime** — Envoyer's offline window was avoidable with current OS and PHP versions. - **Incident commanders should sign off on every customer communication** with a claim-by-claim check against real product status. What Laravel Is Changing ------------------------ - Cloud: in-place patch mechanism retained as standard; stricter runtime version tracking; EOL versions removed. - Forge: deployments now run on a dedicated queue; package sources repaired; surge capacity added. - Envoyer: kept on supported OS and PHP; deployment health checks restored. - Vapor: legacy `al2` runtime marked unsupported; customers being contacted. - All products: recorded war rooms for SEV1/SEV2 incidents; soak periods before recovery announcements. If you run Forge, Vapor, or Envoyer and have not yet updated PHP, the [Forge knowledge base](https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026) walks you through checking your version. --- *Source: [Post Mortem: Patching the PHP and Node.js Vulnerabilities — Laravel Blog](https://laravel.com/blog/php-nodejs-vulnerabilities-post-mortem)* - [security](https://www.msaied.com/articles?search=security) - [post mortem](https://www.msaied.com/articles?search=post%20mortem) - [PHP](https://www.msaied.com/articles?search=PHP) - [Laravel Cloud](https://www.msaied.com/articles?search=Laravel%20Cloud) - [Kubernetes](https://www.msaied.com/articles?search=Kubernetes) - [incident response](https://www.msaied.com/articles?search=incident%20response) Frequently asked questions --------------------------- Did Laravel Cloud customers need to redeploy their applications to get the PHP patch?No. Laravel Cloud patched every running application in place using a custom Kubernetes operator that injected the patched PHP binaries and restarted each pod without customer intervention. The entire fleet was patched in under 5 hours. Why did Forge experience degraded service and cancelled deployments during the incident?The PHP security release triggered roughly 10 times the normal volume of PHP upgrade jobs on Forge. Those jobs shared a queue with deployments and failed repeatedly against flaky upstream package repositories, starving deployments until they timed out. About 4,800 deployments were eventually cancelled. Forge now runs deployments on a dedicated queue to prevent this. What permanent changes did Laravel make to prevent a similar incident from being worse next time?Key permanent changes include: keeping the in-place Kubernetes patch mechanism as a standard tool, retaining Cloudflare firewall rules on all Cloud domains, separating Forge deployment queues from upgrade job queues, requiring a soak period before announcing recoveries, recording all SEV1/SEV2 war rooms, and keeping Envoyer on supported OS and PHP versions to avoid forced downtime. ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp)About the author ---------------- [Mohamed Said](https://www.msaied.com#person)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. [About](https://www.msaied.com#about) [GitHub ↗](https://github.com/EG-Mohamed) [LinkedIn ↗](https://www.linkedin.com/in/msaiedm/) [WhatsApp ↗](https://wa.me/201094619204) [Email Address ↗](mailto:hello@msaied.com) [My CV ↗](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) [Previous articleFlock: A Free, Native Laravel Herd Alternative for macOS, Windows, and Linux](https://www.msaied.com/articles/flock-a-free-native-laravel-herd-alternative-for-macos-windows-and-linux) On this page ------------- 1. [What Happened](#what-happened) 2. [Why the Normal Playbook Did Not Work](#why-the-normal-playbook-did-not-work) 3. [Adding a Firewall Layer First](#adding-a-firewall-layer-first) 4. [Building PHP Independently](#building-php-independently) 5. [Live Patching Running Workloads on Kubernetes](#live-patching-running-workloads-on-kubernetes) 6. [What Broke on Forge, Envoyer, and Vapor](#what-broke-on-forge-envoyer-and-vapor) 7. [Key Takeaways](#key-takeaways) 8. [What Laravel Is Changing](#what-laravel-is-changing) ### Have a technical challenge? Tell me what you’re building. I reply within two working days. [Start a conversation](https://www.msaied.com#contact) Related articles ----------------- [ ![](https://cdn.msaied.com/816/a5801f7786d2c70f010c322468e7d2b0.png) Laravel · 4 min read### Flock: A Free, Native Laravel Herd Alternative for macOS, Windows, and Linux 3 Nov 2026 ](https://www.msaied.com/articles/flock-a-free-native-laravel-herd-alternative-for-macos-windows-and-linux) [ ![](https://cdn.msaied.com/815/cd8ac8b9474dd51212681b4c6dd8a071.png) Laravel · 4 min read### Laravel Email Testing and Sending in One Account with Maileroo 2 Nov 2026 ](https://www.msaied.com/articles/laravel-email-testing-and-sending-in-one-account-with-maileroo) [ ![](https://cdn.msaied.com/814/db8ca6495138bff986574ce8d55b775e.png) Laravel · 3 min read### PIE 1.5 Changes PHP Extension Installs in CI 2 Nov 2026 ](https://www.msaied.com/articles/pie-15-changes-php-extension-installs-in-ci) Have a technical challenge? ---------------------------- Tell me what you’re building. I reply within two working days. [Discuss your project ↗](https://www.msaied.com#contact) © 2026 Mohamed Said · Built with Laravel, meant to last.Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. - [Home](https://www.msaied.com) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [GitHub](https://github.com/EG-Mohamed) - [LinkedIn](https://www.linkedin.com/in/msaiedm/) - [WhatsApp](https://wa.me/201094619204) - [Email Address](mailto:hello@msaied.com) - [My CV](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view) - [Sitemap](https://www.msaied.com/sitemap.xml)