PHP Security Releases Fix Two Critical RCE Vulnerabilities
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities that allow unauthenticated remote code execution. Here's who's at risk and how to update.
Writing on software design, company building, and the aerospace industry.
All of my long-form thoughts on programming, leadership, product design, and more, collected in chronological order.
Prevent Stale Database Reads in Laravel 13.38
Laravel 13.38 adds PreventStaleDatabaseReads middleware and DB::usingWritePdo() so users see their own writes when you read from database replicas.
Critical PHP Security Release Coming Tomorrow (October 21)
The PHP security team will ship a release on October 21, 2026 at 14:00 UTC that fixes two critical vulnerabilities, both rated CVSS 9.2. Plan your upgrade now.
Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68
A critical auth bypass in Laravel's token API guard let attackers log in as other users on MySQL and MariaDB. Update to 12.68.0 or 13.29.0.
Run Large PlanetScale Queries in Laravel With DB::olap()
Laravel's new DB::olap() method runs PlanetScale and Vitess queries in OLAP mode to get past the 100,000 row limit, then switches the connection back.
Fluent Rule Builders for All Laravel Validation Rules
Laravel 13.36 adds Rule:: methods for required_with, accepted_if, url, uuid, distinct, and the other string-only validation rules, with IDE autocompletion.
Laravel URL AI Transformer: Extract Structured Data From URLs
Spatie's Laravel URL AI Transformer fetches web pages, runs them through Laravel AI agents, and stores JSON-LD, summaries, or schema-validated data.
Rule Builders for Every Validation Rule in Laravel 13.36
Laravel 13.36 adds Rule:: builders for the remaining validation rules, DB::olap() for PlanetScale, and an option to reset sticky connections between queue jobs.
PHP News: A New Site for PHP Releases, RFCs, and Packages
PHP News is a new site from Eric Barnes and Matt Stauffer covering PHP core, RFCs, releases, packages, and events, plus a free weekly PHP newsletter.
Pause Polling in Background Tabs in Inertia.js v3.9
Inertia.js v3.9 adds a background option to pause polling in hidden tabs, a navigate event type for history restores, and fixes for back navigation.