Laravel Holdings Inc.

Laravel Cloud

Response status

Running environments patched

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

All running applications received PHP and Node.js security patches and deployments resumed. Normal applications were patched in place without needing redeployment for the PHP fix.

Scope: New deployments use patched base images. Node20 end-of-life action is separate from PHP patch rollout.

What users should do

Check application operation. Environments specifying Node20 must switch to a supported Node.js release and redeploy.

Official service URL

• https://laravel.com/

Source URLs

1. Laravel response to critical PHP vulnerabilitieshttps://laravel.com/blog/php-critical-vulnerability-response-updatesResponse evidence
2. https://laravel.com/bloghttps://laravel.com/blogService and operation documentation

Laravel Forge

Response status

Fix available; user action required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Current instructions cover patched PHP 7.0–8.5 packages. PHP 8.1 and older use backports with unchanged PHP version numbers, requiring package revision verification.

Scope: Automatic security updates do not patch Forge's PHP. The October 21 notice requires migration from Ubuntu 20.04 or older. Existing upload-progress settings are not changed automatically; assess usage and follow the additional official guidance.

What users should do

Update every installed PHP version on each server, restart long-running CLI processes, and verify PHP-FPM and package revisions. Migrate unsupported OS/PHP versions.

Official service URL

• https://laravel.com/

Source URLs

1. https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026Response evidence
2. Laravel response to critical PHP vulnerabilitieshttps://laravel.com/blog/php-critical-vulnerability-response-updatesResponse evidence
3. https://status.on-forge.com/incidents/c642x01rmt7bhttps://status.on-forge.com/incidents/c642x01rmt7bService and operation documentation
4. https://status.on-forge.comhttps://status.on-forge.comService and operation documentation
5. https://laravel.com/bloghttps://laravel.com/blogService and operation documentation

Laravel Vapor

Response status

Patched runtimes available; redeployment required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Patched PHP runtimes are available. Native PHP8.2+ environments still require customer redeployment; custom and Docker environments require a new deployment.

Scope: Runtime availability does not establish that existing applications have adopted the fixes.

What users should do

Redeploy native environments. Use a new deployment, not just a redeploy, for custom/Docker runtimes. Migrate PHP8.0/8.1 to8.2+.

Official service URL

• https://laravel.com/

Source URLs

1. Laravel response to critical PHP vulnerabilitieshttps://laravel.com/blog/php-critical-vulnerability-response-updatesResponse evidence
2. https://laravel.com/bloghttps://laravel.com/blogService and operation documentation

Laravel Envoyer (deployments and health checks)

Response status

Service restoration announced

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Laravel reports normal deployment and health-check operation following work related to the PHP security issue.

Scope: This is a restoration notice, not a statement that user deployment servers were automatically patched.

What users should do

Check deployments and health checks, and separately verify PHP patching on deployment servers.

Source URLs

1. Laravel response to critical PHP vulnerabilitieshttps://laravel.com/blog/php-critical-vulnerability-response-updatesResponse evidence