Laravel Security Guides and Research

Product 7 min read

StackShield Now Has an MCP Server: Run Scans and Triage Issues From ChatGPT, Claude and Cursor

Connect StackShield to any MCP-compatible assistant and ask it to scan a domain, explain a failed test, resolve the issues you have fixed, or write a security report. Included on every plan.

Matt King

September 5, 2026

Tools & Reviews 9 min read

Reading a Laravel Security Scan Report Without Wasting a Week

A scan comes back with 47 findings. Three of them matter this afternoon, most of the rest matter eventually, and a few are noise you should close as accepted. Here is how to sort them, and the sorting mistakes that cost teams the most time.

Matt King

August 28, 2026

Security 11 min read

Multi-Tenant Laravel: The Isolation Bugs No Scanner Will Find

Every external security tool will give a multi-tenant Laravel app a clean bill of health while one customer reads another customer's invoices. Tenant isolation is a business-logic property, and it fails in five places that look completely normal in code review.

Matt King

August 25, 2026

Security 10 min read

The First Hour After You Find a Compromised Laravel Server

The instinct is to delete the web shell and move on. That destroys your evidence, leaves the way back in, and tells the attacker you noticed. Here is a sequence that preserves what you need while actually closing the door.

Matt King

August 21, 2026

Security 9 min read

Packagist Made Stable Versions Immutable. Here Is What That Changes for You.

After the Laravel-Lang compromise, Packagist shipped version immutability, started publishing maintainer MFA status, and put release cooldowns on the roadmap. Some of your assumptions about composer.lock are now out of date, in both directions.

Matt King

August 18, 2026

Vulnerability 8 min read

Laravel Passport Can Authenticate a Machine Token as a Real User (CVE-2026-39976)

A client_credentials token is supposed to represent a machine, not a person. In Passport 13.0.0 through 13.7.0 it can end up authenticated as an unrelated user account. The conditions are specific, which is exactly why teams assume it does not apply to them.

Matt King

August 14, 2026

Security 9 min read

Five Numbers From 10,000 Laravel Applications

We scanned more than 10,000 Laravel applications for the State of Laravel Security 2026 report. Five of the findings changed how we think about what to prioritise, including one that suggests most teams are fixing the wrong thing first.

Matt King

August 11, 2026

Vulnerability 8 min read

Your Temporary Signed URLs May Not Be Expiring

A Laravel advisory published in June means temporary signed URLs on the local filesystem driver can be parsed ambiguously, so an expired link can keep working and a request can resolve to something you did not intend. Moderate severity, but with an unusually long tail.

Matt King

August 7, 2026

Vulnerability 9 min read

Laravel's Default Email Rule Had a CRLF Injection Flaw (CVSS 8.9). Here Is What to Check.

GHSA-5vg9-5847-vvmq scored 8.9 and affects any Laravel app that sends mail to a user-supplied address. That is most registration flows, every contact form, and every password reset. Here is the mechanism, the affected versions, and how to verify you are patched.

Matt King

August 4, 2026

Security 13 min read

Locking Down Your Laravel API: Rate Limiting, Sanctum, and Abuse Prevention

API security goes far beyond authentication. Learn how to combine rate limiting strategies, Sanctum token scoping, request throttling, payload validation, and anomaly detection to protect your Laravel API from brute-force attacks, credential stuffing, and automated abuse.

Matt King

July 30, 2026

Security 11 min read

Insecure Deserialization in PHP: unserialize() Risks Beyond Reverb

A single unserialize() call on attacker-controlled input can turn a vendor class into a remote code execution chain. Here is how PHP object injection works in Laravel apps, why your session cookies are usually safe, and the exact code changes that close the hole.

Matt King

July 21, 2026

Security 15 min read

OWASP Top 10 for AI Agents: What Laravel Teams Using the AI SDK Need to Know

OWASP released a new Top 10 for Agentic Applications in 2026, and Laravel 13 ships with a first-party AI SDK. This guide covers the intersection: prompt injection, excessive agency, insecure tool use, data leakage, and practical Laravel middleware and validation examples to secure your AI-powered features.

Matt King

July 16, 2026

Security 11 min read

Securing Laravel Queues and Background Jobs

Your queue runs code with no user watching, often with elevated access, on payloads sitting in plaintext. Here is how to encrypt sensitive jobs, lock down the backend, validate user input inside handle(), and keep failed_jobs from leaking your secrets.

Matt King

July 14, 2026

Security 11 min read

Security Logging and Monitoring Failures in Laravel (OWASP A09)

Most Laravel apps log application errors but record almost nothing about security events. Here is how to add a dedicated security channel, capture auth events, redact secrets, and alert on attacks before they become breaches.

Matt King

July 9, 2026

Security 12 min read

95% of Cloud Security Failures Are Misconfigurations: A Laravel Deployment Checklist

95% of cloud security failures stem from human error, not platform vulnerabilities. This checklist covers the most common misconfigurations in Laravel deployments: exposed storage buckets, overly permissive IAM, missing network segmentation, database exposure, Redis security, leaked .env files, and debug endpoints left open in production.

Matt King

July 2, 2026

Security 12 min read

Laravel Authorization Done Right: Gates, Policies, and the Holes Teams Leave

Authentication proves who a user is. Authorization decides what they are allowed to touch. Most Laravel apps get the first part right and then load /orders/123 without ever checking the order belongs to the logged-in user. Here is how Gates and Policies actually work, and where the access-control holes hide.

Matt King

June 30, 2026

Security 11 min read

SSRF in Laravel: The Risk Hiding in Http::get()

A single user-supplied URL passed into Laravel's HTTP client can let an attacker read your cloud metadata and steal IAM credentials. Here is how SSRF works and how to build a URL validator that actually blocks it.

Matt King

June 25, 2026

Security 12 min read

Adding Two-Factor Authentication to Laravel with Fortify

A working password is no longer enough. Here is how to wire up TOTP-based two-factor authentication in Laravel using Fortify, from the migration columns through the QR challenge, and how to force every admin account to enrol.

Matt King

June 23, 2026

Security 14 min read

Securing Your Laravel CI/CD Pipeline: A Practical DevSecOps Guide

With 70% of teams releasing continuously, your CI/CD pipeline is a high-value target. This guide covers securing GitHub Actions and GitLab CI for Laravel projects: secrets management, composer audit integration, SAST scanning, container security, deployment hardening, and artifact signing with practical YAML configs.

Matt King

June 16, 2026

Security 10 min read

Laravel Mass Assignment: How $fillable and $guarded Go Wrong

Mass assignment turns a tidy one-liner into a privilege-escalation bug. Here is how attackers set is_admin=1 through your profile form, and the exact Eloquent patterns that stop them.

Matt King

June 11, 2026

Security 11 min read

SQL Injection in Laravel: Where Eloquent Protects You and Where It Doesn't

Eloquent and the Query Builder bind your values through PDO prepared statements, so a plain where() is safe. The trouble starts with whereRaw, dynamic orderBy, and LIKE wildcards. Here is exactly where the gaps are.

Matt King

June 9, 2026

Security 11 min read

Laravel Security Scans in GitHub Actions: A CI/CD Pipeline Guide

Automate Laravel security checks in your GitHub Actions pipeline. Set up composer audit, static analysis, StackShield post-deploy scans, and block merges when vulnerabilities are found.

Matt King

June 4, 2026

Security 12 min read

Laravel Content Security Policy: Configure CSP Without Breaking Your App

Only 22% of Laravel apps have a Content Security Policy. Learn how to implement CSP with spatie/laravel-csp, handle Livewire and Vite nonces, and avoid the mistakes that break production.

Matt King

May 30, 2026

Security 8 min read

Laravel Is Now on the Same Federal Vulnerability List as Apple. Here Is What That Means.

CISA added the Livewire RCE vulnerability (CVE-2025-54068) to the Known Exploited Vulnerabilities catalog, linking it to active exploitation by Iranian APT MuddyWater. A Laravel ecosystem package is now on the same US government list as Apple and Microsoft. Here is what that changes for your team.

Matt King

May 28, 2026

Security 8 min read

Copy Fail: Why Every Laravel Server Needs a Kernel Update Right Now (CVE-2026-31431)

A local privilege escalation vulnerability in the Linux kernel affects every server running a kernel from 2017 onward. Laravel Forge has issued a specific advisory. The exploit is 732 bytes, works reliably, and is active in the wild. Here is what Laravel teams need to do.

Matt King

May 26, 2026

Security 9 min read

Composer's Hidden Attack Surface: How Two Command Injection Flaws Put Every PHP Project at Risk

Two command injection vulnerabilities in Composer's Perforce driver (CVE-2026-40261 and CVE-2026-40176) can be exploited even if Perforce is not installed on your system. Malicious package metadata from any Composer repository can trigger arbitrary shell command execution. Update to Composer 2.9.6 immediately.

Matt King

May 23, 2026

Security 9 min read

The Intercom PHP Hack: How a Composer Plugin Stole Credentials From Thousands of Developers

On April 30, 2026, attackers compromised intercom/intercom-php on Packagist (20.7 million lifetime installs). The malicious version auto-executed as a Composer plugin, downloading Bun and exfiltrating GitHub tokens, SSH keys, and environment variables. Here is what happened and how to protect yourself.

Matt King

May 21, 2026

Security 10 min read

CVE-2026-23524: Laravel Reverb RCE via Insecure Deserialization (CVSS 9.8)

Laravel Reverb versions 1.6.3 and below have a critical insecure deserialization vulnerability. When horizontal scaling is enabled, Reverb passes Redis channel data directly into unserialize() without class restrictions. If your Redis is unauthenticated, attackers can achieve full remote code execution. Here is how to check and fix it.

Matt King

May 19, 2026

Security 11 min read

Laravel 13 Security: What Changed from Laravel 12 and What You Need to Know

A security-focused review of Laravel 13 for teams upgrading from Laravel 12. Covers new defaults, deprecated patterns, configuration changes, and a post-upgrade security checklist.

Matt King

May 16, 2026

Security 15 min read

PHP Security Audit: A Developer's Guide Beyond Laravel

A comprehensive PHP security audit guide covering dependency scanning, php.ini hardening, input validation, common vulnerability classes, static analysis tools, and web server configuration.

Matt King

May 14, 2026

Security 12 min read

Laravel Session Security: Cookies, Hijacking & config/session.php

A deep dive into Laravel session security. Learn how cookie flags, session drivers, and config/session.php settings protect against hijacking, fixation, and sidejacking attacks.

Matt King

May 9, 2026

Security 14 min read

Automated Security Testing in Laravel CI/CD Pipelines

How to add security gates to your Laravel CI/CD pipeline with GitHub Actions. Covers dependency scanning, static analysis, secret detection, and automated security monitoring.

Matt King

May 7, 2026

Security 10 min read

Securing Laravel Horizon in Production: A Complete Guide

Laravel Horizon exposes your entire queue system, including job payloads, failed jobs with user data, and worker status. Here is how to lock it down properly in production.

Matt King

May 2, 2026

Security 16 min read

How to Pentest a Laravel Application: A Practical Methodology

A step-by-step external penetration testing methodology for Laravel applications. Covers reconnaissance, fingerprinting, common exploit paths, tools, and when to hire a professional.

Matt King

April 30, 2026

Security 10 min read

Open Ports in Production: Why Your Laravel Server Has More Exposed Services Than You Think

Most Laravel deployments expose far more network services than developers realise. From MySQL and Redis to forgotten Vite dev servers, open ports give attackers a roadmap to your infrastructure. Here is how to find and close them.

Matt King

April 28, 2026

Security 12 min read

Laravel XSS Protection: Blade, Livewire, and Raw Output

Cross-site scripting bypasses Laravel's default escaping more often than you think. Cover Blade's triple-brace pitfall, Livewire injection, and raw HTML output.

Matt King

April 27, 2026

Security 11 min read

Security Headers for SOC 2 and ISO 27001: What Laravel Teams Need to Know

SOC 2 and ISO 27001 audits increasingly flag missing or misconfigured security headers. Learn which headers auditors look for, how to implement them in Laravel middleware, and how to monitor compliance continuously.

Matt King

April 24, 2026

Security 10 min read

PHP Supply Chain Attacks: How Malicious Packages Sneak Into composer.json

Typosquatting, dependency confusion, and hijacked maintainer accounts. A breakdown of how PHP supply chain attacks work, real incidents, and what you can do to protect your Composer dependencies.

Matt King

April 22, 2026

Security 10 min read

The Vercel Breach: What Happened, Who Is Affected, and What You Should Do Right Now

Vercel confirmed a security breach on April 19, 2026 after attackers compromised a third-party AI tool to pivot into internal systems. Environment variables, API keys, and deployment data were exposed. Here is what happened and how to protect your applications.

Matt King

April 20, 2026

Security 12 min read

Laravel File Upload Security: 7 Vulnerabilities Attackers Exploit

File uploads are one of Laravel's most dangerous attack surfaces. Learn how attackers exploit validation gaps, path traversal, and storage misconfigs to achieve RCE.

Matt King

April 14, 2026

Security 11 min read

Subdomain Takeover: How Dangling DNS Records Put Your Laravel App at Risk

Dangling DNS records are one of the most overlooked attack vectors in Laravel deployments. Learn how subdomain takeover works, why deprovisioned cloud resources create exploitable gaps, and how to protect your application.

Matt King

April 7, 2026

Security 10 min read

5 CORS Misconfigurations in Laravel That Create Vulnerabilities

Wildcard origins, reflected headers, and exposed credentials. These five CORS misconfigurations in Laravel let attackers bypass same-origin protections.

Matt King

March 31, 2026

Security 12 min read

The OWASP Top 10 Just Changed. Here Is What It Means for Laravel Teams.

The OWASP Top 10 2025 added supply chain failures at #3 and error handling at #10, while injection dropped to #5. Here is the full updated list and what Laravel developers need to do differently.

Matt King

March 24, 2026

Security 12 min read

NIST SP 800-81r3 DNS Security: 6 Changes That Affect Your Infrastructure in 2026

The first NIST DNS security update since 2013. New guidance on Protective DNS, encrypted DNS (DoH/DoT), DNSSEC, and dangling record cleanup. Here are the 6 key changes and what to do.

Matt King

March 23, 2026

Vulnerability 8 min read

CVE-2025-54068: Critical Livewire RCE Vulnerability in Laravel (How to Fix)

CVE-2025-54068 is a critical remote code execution vulnerability in Livewire v3 that allows unauthenticated attackers to execute arbitrary code on your server. With 130,000+ applications affected, here is how to check if you are vulnerable and patch it.

Matt King

March 19, 2026

Security 8 min read

Fake Laravel Packages on Packagist Are Installing Backdoors. Here Is How to Check.

Three malicious Packagist packages disguised as Laravel utilities deploy a cross-platform RAT that gives attackers full shell access, reads your .env, and exfiltrates credentials. Here is what happened, how to check if you are affected, and what to do.

Matt King

March 16, 2026

Security 8 min read

GitLab 2FA Bypass (CVE-2026-0723): What Happened and How to Protect Yourself

GitLab patched a high-severity two-factor authentication bypass (CVE-2026-0723, CVSS 7.4) that lets attackers hijack accounts. Here is what the vulnerability is, who is affected, and how to remediate it.

Matt King

March 12, 2026

Security 10 min read

AI Is Writing Your Laravel Code. Who Is Checking Its Security?

Laravel's AI SDK, Boost, and tools like Cursor and Claude Code are changing how we build applications. But over 40% of AI-generated code contains security flaws. Here is how to ship faster without opening the door to attackers.

Matt King

March 12, 2026

Security 15 min read

The Complete Laravel Security Checklist for 2026

A comprehensive, 30-point security checklist covering every layer of your Laravel application. From .env protection and security headers to debug mode detection and DNS security.

Matt King

March 11, 2026

Security 10 min read

What Is External Attack Surface Management (EASM)?

External Attack Surface Management continuously discovers and monitors your internet-facing assets for security risks. Learn how EASM differs from DAST, SAST, and pentesting, and why every team shipping web apps needs it.

Matt King

March 11, 2026

Security 18 min read

Laravel Security: The Complete Hardening Guide

The complete production hardening guide for Laravel. Covers headers, sessions, environment config, rate limiting, authentication, and continuous monitoring.

Matt King

March 11, 2026

Tools & Reviews 12 min read

Best Laravel Security Tools Compared: Scanners, Monitors & Audit Tools (2026)

Compare the best security tools for Laravel. Covers static analysis, dependency scanning, external monitoring, penetration testing, and WAFs with a feature comparison table.

Matt King

March 10, 2026

Security 10 min read

Continuous Security Monitoring vs Annual Pentesting: What Your Laravel App Actually Needs

A side-by-side comparison of continuous security monitoring and annual penetration testing. Learn when you need each, what they cost, and how they work together to protect your Laravel application.

Matt King

March 10, 2026

Security 8 min read

Laravel Debug Mode in Production: What Attackers See

18% of Laravel apps run debug mode in production. Attackers use exposed stack traces, environment variables, and database credentials to compromise your app.

Matt King

March 9, 2026

Security 16 min read

OWASP Top 10 in Laravel: Real Vulnerabilities, Real Code Fixes (2026)

SQL injection through raw queries. XSS from unescaped Blade output. CSRF bypasses on API routes. Every OWASP Top 10 category mapped to Laravel-specific vulnerabilities with code you can copy to fix them.

Matt King

March 9, 2026

Security 8 min read

Your Laravel .env File Is Probably Exposed Right Now

12% of Laravel apps have publicly accessible .env files. Learn how attackers find them, what they steal, and how to verify yours is protected.

Matt King

March 8, 2026

Security 8 min read

Laravel Telescope in Production: Security Risks You Need to Know

Laravel Telescope records every request, query, job, and log entry in your application. Left exposed in production, it gives attackers a real-time view into your entire system.

Matt King

March 8, 2026

Security 10 min read

What Is an Attack Surface? A Developer's Guide

An attack surface is the total number of points where an attacker can try to enter or extract data from your system. Understanding yours is the first step to reducing it.

Matt King

March 7, 2026

Security 10 min read

Composer Audit: Find Vulnerable PHP Packages Before Attackers Do

Your composer.lock probably has vulnerable packages right now. Run composer audit to find them, fix with targeted updates, and add automated vulnerability scanning to your CI/CD pipeline so nothing ships unpatched.

Matt King

March 7, 2026

Security 10 min read

Laravel Security Resources: Every Fix Guide, Check and Checklist

The complete index of Laravel security resources. Find fix guides for exposed .env files, debug mode, XSS, CSRF, CORS, session security, and more. Plus checklists, comparison pages, and free scanning tools.

Matt King

March 6, 2026

Security 6 min read

A Guide to Security Headers: What They Do and How to Secure Your Laravel Application

Discover how to secure your Laravel application with the right security headers.

Matt King

March 6, 2026

Blog

StackShield Now Has an MCP Server: Run Scans and Triage Issues From ChatGPT, Claude and Cursor

Reading a Laravel Security Scan Report Without Wasting a Week

Multi-Tenant Laravel: The Isolation Bugs No Scanner Will Find

The First Hour After You Find a Compromised Laravel Server

Packagist Made Stable Versions Immutable. Here Is What That Changes for You.

Laravel Passport Can Authenticate a Machine Token as a Real User (CVE-2026-39976)

Five Numbers From 10,000 Laravel Applications

Your Temporary Signed URLs May Not Be Expiring

Laravel's Default Email Rule Had a CRLF Injection Flaw (CVSS 8.9). Here Is What to Check.

Locking Down Your Laravel API: Rate Limiting, Sanctum, and Abuse Prevention

Insecure Deserialization in PHP: unserialize() Risks Beyond Reverb

OWASP Top 10 for AI Agents: What Laravel Teams Using the AI SDK Need to Know

Securing Laravel Queues and Background Jobs

Security Logging and Monitoring Failures in Laravel (OWASP A09)

95% of Cloud Security Failures Are Misconfigurations: A Laravel Deployment Checklist

Laravel Authorization Done Right: Gates, Policies, and the Holes Teams Leave

SSRF in Laravel: The Risk Hiding in Http::get()

Adding Two-Factor Authentication to Laravel with Fortify

Securing Your Laravel CI/CD Pipeline: A Practical DevSecOps Guide

Laravel Mass Assignment: How $fillable and $guarded Go Wrong

SQL Injection in Laravel: Where Eloquent Protects You and Where It Doesn't

Laravel Security Scans in GitHub Actions: A CI/CD Pipeline Guide

Laravel Content Security Policy: Configure CSP Without Breaking Your App

Laravel Is Now on the Same Federal Vulnerability List as Apple. Here Is What That Means.

Copy Fail: Why Every Laravel Server Needs a Kernel Update Right Now (CVE-2026-31431)

Composer's Hidden Attack Surface: How Two Command Injection Flaws Put Every PHP Project at Risk

The Intercom PHP Hack: How a Composer Plugin Stole Credentials From Thousands of Developers

CVE-2026-23524: Laravel Reverb RCE via Insecure Deserialization (CVSS 9.8)

Laravel 13 Security: What Changed from Laravel 12 and What You Need to Know

PHP Security Audit: A Developer's Guide Beyond Laravel

Laravel Session Security: Cookies, Hijacking & config/session.php

Automated Security Testing in Laravel CI/CD Pipelines

Securing Laravel Horizon in Production: A Complete Guide

How to Pentest a Laravel Application: A Practical Methodology

Open Ports in Production: Why Your Laravel Server Has More Exposed Services Than You Think

Laravel XSS Protection: Blade, Livewire, and Raw Output

Security Headers for SOC 2 and ISO 27001: What Laravel Teams Need to Know

PHP Supply Chain Attacks: How Malicious Packages Sneak Into composer.json

The Vercel Breach: What Happened, Who Is Affected, and What You Should Do Right Now

Laravel File Upload Security: 7 Vulnerabilities Attackers Exploit

Subdomain Takeover: How Dangling DNS Records Put Your Laravel App at Risk

5 CORS Misconfigurations in Laravel That Create Vulnerabilities

The OWASP Top 10 Just Changed. Here Is What It Means for Laravel Teams.

NIST SP 800-81r3 DNS Security: 6 Changes That Affect Your Infrastructure in 2026

CVE-2025-54068: Critical Livewire RCE Vulnerability in Laravel (How to Fix)

Fake Laravel Packages on Packagist Are Installing Backdoors. Here Is How to Check.

GitLab 2FA Bypass (CVE-2026-0723): What Happened and How to Protect Yourself

AI Is Writing Your Laravel Code. Who Is Checking Its Security?

The Complete Laravel Security Checklist for 2026

What Is External Attack Surface Management (EASM)?

Laravel Security: The Complete Hardening Guide

Best Laravel Security Tools Compared: Scanners, Monitors & Audit Tools (2026)

Continuous Security Monitoring vs Annual Pentesting: What Your Laravel App Actually Needs

Laravel Debug Mode in Production: What Attackers See

OWASP Top 10 in Laravel: Real Vulnerabilities, Real Code Fixes (2026)

Your Laravel .env File Is Probably Exposed Right Now

Laravel Telescope in Production: Security Risks You Need to Know

What Is an Attack Surface? A Developer's Guide

Composer Audit: Find Vulnerable PHP Packages Before Attackers Do

Laravel Security Resources: Every Fix Guide, Check and Checklist

A Guide to Security Headers: What They Do and How to Secure Your Laravel Application

Stay Updated on Laravel Security