PHP Security Releases Fix Two Critical RCE Vulnerabilities
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities that allow unauthenticated remote code execution. Here's who's at risk and how to update.
Writing on software design, company building, and the aerospace industry.
All of my long-form thoughts on programming, leadership, product design, and more, collected in chronological order.
Reset Sticky Database Connections Between Laravel Queue Jobs
Laravel 13.36 adds Worker::$flushStickyConnections so queue jobs go back to your read replicas after an earlier job writes to the database.
Screenshot: Capture Images and PDFs with PHP and Laravel
Screenshot captures HTML, Blade views, and web pages as PNG, JPEG, or PDF files with Chrome, then saves them locally or to Laravel filesystem disks.
Prevent Stale Database Reads in Laravel 13.38
Laravel 13.38 adds PreventStaleDatabaseReads middleware and DB::usingWritePdo() so users see their own writes when you read from database replicas.
Critical PHP Security Release Coming Tomorrow (October 21)
The PHP security team will ship a release on October 21, 2026 at 14:00 UTC that fixes two critical vulnerabilities, both rated CVSS 9.2. Plan your upgrade now.
Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68
A critical auth bypass in Laravel's token API guard let attackers log in as other users on MySQL and MariaDB. Update to 12.68.0 or 13.29.0.
Run Large PlanetScale Queries in Laravel With DB::olap()
Laravel's new DB::olap() method runs PlanetScale and Vitess queries in OLAP mode to get past the 100,000 row limit, then switches the connection back.
Fluent Rule Builders for All Laravel Validation Rules
Laravel 13.36 adds Rule:: methods for required_with, accepted_if, url, uuid, distinct, and the other string-only validation rules, with IDE autocompletion.
Laravel URL AI Transformer: Extract Structured Data From URLs
Spatie's Laravel URL AI Transformer fetches web pages, runs them through Laravel AI agents, and stores JSON-LD, summaries, or schema-validated data.
Rule Builders for Every Validation Rule in Laravel 13.36
Laravel 13.36 adds Rule:: builders for the remaining validation rules, DB::olap() for PlanetScale, and an option to reset sticky connections between queue jobs.