Magento and Adobe Commerce zero-day CVE-2026-75650 under active attack, hotfix available

Laravel Cloud adds Next.js and Nuxt deployment from Laravel monorepos

PHP 8.6 adds partial function application to complement the pipe operator

Elementor Pro CVE-2026-32475 sees 190K blocked exploit attempts via file upload bypass

Slim 4.15.3 patches route parameter constraint bypass vulnerability

Laravel ships first-party language server for any LSP-compatible editor

WordPress narrows vulnerability disclosure scope to high-impact privilege escalations

WordPress is updating its Vulnerability Disclosure Program guidelines, run through HackerOne, to narrow the scope of eligible reports. For any in-scope asset other than WordPress Core and Gutenberg, issues requiring an administrator-granted role (such as Contributor) will generally no longer qualify unless they show a high-severity escalation. Similarly, one authenticated role being able to perform another role's action won't be sufficient on its own unless it leads to high-impact escalation. WordPress Core and Gutenberg keep the existing eligibility rules for now. The change is part of a broader Core Security Initiative aimed at focusing researcher and team time on vulnerabilities with clear, significant security impact, especially unauthenticated or low-privilege (Subscriber-level) exploits.

13 malicious Packagist themes deliver iOS spyware stealing crypto wallet seeds

<p>Socket’s Threat Research Team found 13 malicious Composer/Packagist theme packages, spread across five vendor namespaces, that trojanize front-end assets for Vietnamese movie and comic streaming sites built on OphimCMS and KKPhim (both Laravel-based PHP CMSes).</p>
<p>The injected JavaScript runs two separate attack chains. The first redirects mobile visitors to ad-fraud and gambling sites. The second, more serious chain targets unpatched iPhones: it weaponizes CVE-2025-31277, CVE-2025-43529, and a variant of CVE-2026-43655 to escape WebKit into the kernel and install spyware.</p>
<p>Once installed, the spyware harvests keychain data, SMS messages, photos, contacts, and location history. It also specifically targets crypto wallet seeds and mnemonics from Bitget, Phantom, Trust Wallet, OKX, and others.</p>
<p>Apple confirmed the kernel escape was patched in iOS/macOS 26.1. Devices running iOS 26.2 or 18.7.3 and above are not exposed. Older iPhones (XS through 16) still on iOS 18.4 through 18.6.x remain at risk.</p>
<p>The campaign runs on FUNNULL (Triad Nexus) infrastructure, a sanctioned provider previously tied to the <a href="http://Polyfill.io" target="_blank" rel="noopener nofollow">Polyfill.io</a> supply chain incident. Attribution is split: independent Vietnamese-speaking theme operators appear responsible for the CMS packages, while a separate Chinese gambling operation is abusing npm as a configuration dead-drop.</p>
<p>If you run a site using these CMSes, audit your installed themes against the named vendor namespaces, remove any matches, rotate credentials, and update affected iPhones off vulnerable iOS versions.</p>


Socket's Threat Research Team uncovered 13 malicious Composer/Packagist theme packages, spread across five vendor namespaces, that trojanize front-end assets on Vietnamese streaming sites built with OphimCMS and KKPhim (Laravel-based PHP CMSes). Injected JavaScript runs two attack chains: one redirects mobile users to ad-fraud and gambling sites, the other targets unpatched iPhones by chaining CVE-2025-31277, CVE-2025-43529, and a CVE-2026-43655 variant to escape WebKit into the kernel and install spyware that steals keychain data, SMS, photos, contacts, location, and crypto wallet seeds from Bitget, Phantom, Trust Wallet, and OKX. Apple patched the kernel escape in iOS/macOS 26.1; devices on iOS 26.2 or 18.7.3+ are safe, but older iPhones (XS through 16) on iOS 18.4-18.6.x remain exposed. The campaign runs on the sanctioned FUNNULL/Triad Nexus infrastructure previously linked to the Polyfill.io incident, with Vietnamese operators running the CMS packages and a separate Chinese gambling operation using npm as a config dead-drop. Site operators are urged to audit installed themes against the named namespaces, remove matches, rotate credentials, and update affected iPhones.

Laravel Scout adds semantic and hybrid vector search with pg_vector and Turbopuffer

<p>Laravel 13.30 is a fairly packed release. Here’s a rundown of what’s new and what changed.</p>
<h2>Collections get chunkBy()</h2>
<p>The new <code>chunkBy()</code> method starts a new chunk whenever a resolved key or callback value changes. It replaces the common <code>chunkWhile()</code> comparison pattern with something more readable when you’re grouping by a changing value rather than a condition between adjacent items.</p>
<h2>Storage::path() now validates paths</h2>
<p><code>Storage::path()</code> now runs through the same <code>WhitespacePathNormalizer</code> used by every other Flysystem call. Paths that escape the disk root will throw <code>PathTraversalDetected</code> instead of silently returning a string pointing outside the disk. If your code relies on <code>..</code> segments in storage paths, it will now throw.</p>
<h2>queue:work prints why the worker stopped</h2>
<p>This one’s genuinely useful. <code>queue:work</code> now prints the stop reason as its final output line, and includes it as a structured field when you pass <code>--json</code>. The <code>WorkerStopping</code> event already carried this data, but previously you had to write a custom listener to surface it.</p>
<p><code>WorkerStopReason</code> covers nine scenarios:</p>
<ul>
<li><code>empty</code> / <code>empty_for</code> - queue drained</li>
<li><code>max_jobs</code> / <code>max_time</code> - limits reached</li>
<li><code>restart_signal</code> - graceful restart</li>
<li><code>interrupted</code> - signal received</li>
<li><code>lost_connection</code> - connection dropped</li>
<li><code>memory</code> - memory limit hit</li>
<li><code>timed_out</code> - job ran too long</li>
</ul>
<p>The two worth setting up alerts for are <code>memory</code> and <code>timed_out</code> - they signal leaks or jobs running longer than expected. Nothing is printed under <code>--quiet</code>, <code>--silent</code>, or when a worker is killed externally (OOM, SIGKILL) before the event fires.</p>
<h2>DevCommands gets more control</h2>
<p><code>DevCommands::withoutVendorCommands()</code> and <code>withoutDefaultCommands()</code> let you exclude vendor-provided and framework default processes from <code>php artisan dev</code>. Combined with the existing <code>only()</code> and <code>except()</code> methods, you now have full control over which dev processes run. The <code>dev:list</code> command (with a <code>--json</code> flag) shows exactly what’s registered. Contributed by Jack Bayliss in PR #61344.</p>
<h2>Artisan::commandNamed()</h2>
<p>New helper for resolving a single Artisan command lazily by name, without booting the full command list.</p>
<h2>Native sqlsrv: DSN parsing for SQL Server</h2>
<p>SQL Server connections now support native <code>sqlsrv:</code> DSN parsing, which should simplify configuration in some environments.</p>
<h2>Cloud queue total size methods</h2>
<p>The Cloud queue driver gets methods for inspecting total queue size, useful for monitoring and autoscaling decisions.</p>
<h2>Ecosystem additions (13.x)</h2>
<p>A few broader 13.x additions worth knowing about:</p>
<ul>
<li><strong>Cloud facade</strong> for inspecting Laravel Cloud at runtime</li>
<li><strong>Read-through filesystem driver</strong> for gradual disk migration</li>
<li><strong>AsVector Eloquent cast</strong> for MariaDB and PostgreSQL vector columns</li>
<li><strong>MariaDB vector query support</strong> added to match PostgreSQL</li>
<li><strong>PhpRedis automatic reconnect/retry</strong> on transient failures</li>
<li><strong>DebounceFor attribute</strong> usable on queued event listeners</li>
<li><strong>queue:pause/resume --all</strong> commands with new events</li>
<li><strong>Turbopuffer engine for Scout</strong></li>
<li><strong>Semantic and hybrid search for Scout</strong> - works with the database driver (via pg_vector), Meilisearch, and the new Turbopuffer driver</li>
<li><strong>RepairToolCalls attribute</strong> for Laravel AI agents to recover from unknown tool calls</li>
</ul>
<h2>Bug fixes</h2>
<ul>
<li>A <code>route:cache</code> bug that left facades pointed at a discarded application instance</li>
<li>A 500 error from <code>Request::clamp()</code> on non-numeric input</li>
<li>Several queue, seeding, and validation issues</li>
</ul>


Laravel 13.x introduces semantic and hybrid search in Laravel Scout, supporting vector similarity and full-text search across three drivers: Database (via pg_vector on PostgreSQL), Meilisearch, and a new Turbopuffer engine. A RepairToolCalls attribute helps AI agents recover from unknown tool calls. Eloquent gains an AsVector cast for MariaDB and PostgreSQL, with MariaDB now supporting vector query methods previously limited to PostgreSQL. Other additions include a read-through filesystem driver for gradual disk migrations, queue:pause/resume --all flags, new pause/resume events, a DebounceFor attribute for queued listeners, automatic PhpRedis reconnection on transient failures, and a new Cloud facade for inspecting Laravel Cloud environments at runtime. Most changes are additive and don't require existing app changes.

Symfony 6.4, 7.4 and 8.1 ship coordinated security hardening releases

Symfony 7.4.18 is out, packing an unusually large batch of security-hardening fixes across HttpClient, HttpFoundation, Security, Mailer/Notifier webhook signature verification, Messenger, and more. Notable fixes include rejecting decompression bombs, blocking cross-authority Host header leaks, rejecting cleartext HTTPS proxies, capping RateLimiter burst sizes, rejecting malformed login link parameters, and validating webhook timestamps for Mailgun, SendGrid, Vonage, Postmark, and Mailomat. Translation reviews for several languages round out the release.

PHP 8.6 RFC passes to allow default values on readonly properties

GiveWP WordPress donation plugin gets max-severity RCE patch after prior breach

A maximum-severity vulnerability (CVE-2026-82222) in the GiveWP WordPress donation plugin lets unauthenticated attackers execute arbitrary commands on the hosting server. Patchstack researchers found the flaw chains an unsafe PHP unserialize helper, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in bundled libraries. An exposed unauthenticated registration action lets attackers create accounts even when registration is disabled, then inject a malicious object via a crafted donation that gets stored in the wp_give_sessions table and executed on the next page request. Versions 4.16.6 through 4.16.7.1 are affected when a site has a legacy donation form lacking 'formBuilderSettings'. GiveWP fixed the issue in version 4.16.7.2, released August 27, by blocking serialized data during donation processing and purging existing malicious payloads. GiveWP was previously exploited to breach Pi-hole, exposing 30,000 donor records.

Laravel starter kits switch to Vite+ unified toolchain, dropping ESLint and Prettier

<p>All Laravel starter kits — React, Vue, Svelte, and Livewire — now ship with Vite+, a unified toolchain from VoidZero. Taylor Otwell announced the switch, which landed via <a href="https://github.com/laravel/maestro/pull/60" target="_blank" rel="noopener nofollow">laravel/maestro PR #60</a>, pinning vite-plus at 0.3.0.</p>
<h2>What is Vite+?</h2>
<p>Vite+ wraps several tools — Vite, Rolldown, Vitest, tsdown, Oxlint, Oxfmt, and Vite Task — behind a single <code>vp</code> CLI. The practical effect is fewer config files and fewer scripts to maintain.</p>
<p>ESLint and Prettier are gone. Separate lint and format scripts collapse into a single <code>vp check</code> command that handles formatting (via Oxfmt), linting (via Oxlint), and type-checking in one pass. Config for both now lives inside <code>vite.config.ts</code> under <code>lint</code> and <code>fmt</code> keys, replacing the old <code>eslint.config.js</code> and <code>.prettierrc</code> files.</p>
<h2>Per-stack changes</h2>
<ul>
<li><strong>React</strong> — adopts <code>@vitejs/plugin-react</code> v6 with React Compiler support via <code>@rolldown/plugin-babel</code></li>
<li><strong>Svelte</strong> — switches from <code>lucide-svelte</code> to <code>@lucide/svelte</code></li>
<li><strong>Vue and Livewire</strong> — pick up the same toolchain consolidation without major stack-specific changes</li>
</ul>
<h2>Migrating existing projects</h2>
<p>Existing projects can run <code>vp migrate</code> to get started, though the migration guide notes that complex projects may need some manual follow-up after the automated migration.</p>


All Laravel starter kits (React, Vue, Svelte, Livewire) now ship with Vite+, a unified toolchain from VoidZero that bundles Vite, Rolldown, Vitest, tsdown, Oxlint, Oxfmt, and Vite Task under a single vp CLI. Taylor Otwell announced the switch, which landed via a PR pinning vite-plus at 0.3.0. ESLint and Prettier configs are removed in favor of a single vp check command handling formatting, linting, and type-checking, with config now living inside vite.config.ts under lint and fmt keys. React starter kits also pick up @vitejs/plugin-react v6 with React Compiler support, and Svelte switches from lucide-svelte to @lucide/svelte. Existing projects can run vp migrate to automate the transition, though complex projects may need manual follow-up.

WordPress launches Core Security Initiative to handle AI-driven surge in vulnerability reports

WordPress core security team announced the Core Security Initiative, a coordinated effort to handle a surge in incoming security reports driven by AI-assisted vulnerability research. The initiative rests on three pillars: building a more automated, predictable security release process; bringing on more contributors to clear the backlog of open reports toward zero; and using AI-assisted scanning to proactively find vulnerabilities. Researchers are still asked to report through HackerOne and follow the official guidelines, with report quality emphasized given the increased volume.

Critical RCE chain in Avada WordPress theme patched after agentic exploit discovery

A critical vulnerability chain (CVE-2026-18431, CVSS 9.8) in the popular Avada WordPress theme and its Fusion Builder plugin lets unauthenticated attackers achieve remote code execution by chaining six separate authorization, input-validation, trust-boundary, and file-handling flaws in a specific order. Wordfence's Argus agentic framework discovered and built a working exploit for the chain in about two hours. Exploitation requires vulnerable versions of both Avada (up to 7.16) and Fusion Builder (up to 3.16) active simultaneously, which narrows the pool of exploitable sites despite Avada having sold over a million licenses. ThemeFusion patched the issue in Avada 7.16.1 and Fusion Builder 3.16.1 after being notified.

Swoole open-sources TypePHP, an ahead-of-time compiler that compiles PHP to native binaries

Swoole's team has open sourced TypePHP, an ahead-of-time compiler that translates PHP source into C++ and then into native machine code, producing native binaries, PHP extensions, or shared libraries. Unlike a bytecode cache, it doesn't interpret opcodes at runtime, instead generating statically-typed C++ for hot paths while still interoperating with the Zend runtime for dynamic values, reflection, and internal functions via PHPX. TypePHP is written entirely in PHP and is self-hosting, meaning its own compiler binary is built by compiling TypePHP's PHP source with itself. The release landed earlier than its planned October timeline.

Attackers exploit miniOrange WordPress plugin auth bypass to forge admin sessions

Attackers are actively exploiting two chained vulnerabilities, CVE-2026-61979 and CVE-2026-15981, in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that allow forging SAML responses and logging in as an administrator. The plugin accepts an attacker-chosen signature algorithm and mishandles OpenSSL verification errors, letting a known IdP public key be abused as a shared secret to forge valid signatures. Both bugs were disclosed and patched in July across all seven plugin editions, but the vendor's public advisory only covered the free edition, leaving 30,000 paid customers unaware despite fixes being available. DigitalOcean blocked a suspicious admin session tied to this exploit chain on August 16, and Patchstack has observed scanning and exploitation attempts from six IP addresses across multiple continents. Because paid editions don't show update warnings in the WordPress dashboard, site owners must manually check and upgrade to patched versions.

PHP 8.6 hits soft feature freeze with partial application and clamp() locked in

PHP Foundation launches ecosystem security team backed by Alpha-Omega grant

Laracon US 2026 brings Laravel LSP, Pest 5, and major Laravel Cloud updates

Critical Elementor Pro file upload flaw allows unauthenticated RCE on WordPress sites

<p>A critical vulnerability in Elementor Pro let unauthenticated attackers upload PHP files and run arbitrary code on WordPress sites — no login required. Tracked as CVE-2026-32475 (CVSS 9.0), the bug affects all Elementor Pro versions up to 4.2.1 and was fixed in 4.2.2, released August 19, 2026.</p>
<h2>How the bug worked</h2>
<p>The problem lives in Elementor Pro’s Forms module, specifically in how it handles the File Upload field. The plugin validates file extensions and moves uploaded files in two separate loops instead of checking each file right before moving it. That gap is exploitable.</p>
<p>Here’s the trick: an attacker submits two file parts for a single File Upload field, with one part carrying an empty filename. The validation loop gets confused by the mismatch and lets a malicious PHP file slip past the extension blocklist. The processing loop then moves that file into a publicly accessible directory anyway.</p>
<p>Exploitation isn’t trivial, but it’s not exotic either. It requires:</p>
<ul>
<li>A published Elementor form with a File Upload field</li>
<li>Multiple file upload enabled on that field (this is off by default, which limits exposure somewhat)</li>
</ul>
<p>Once the payload lands, the attacker still needs to find it. Elementor names uploaded files using PHP’s time-based <code>uniqid()</code> function, which sounds random but isn’t cryptographically secure. Attackers can brute-force the filename by timing their upload and guessing nearby values, then simply request the file’s URL to execute it.</p>
<h2>Timeline</h2>
<p>Elementor was notified on July 16 and shipped a fix the very next day, rolling it into the public 4.2.2 release on August 19. No proof-of-concept has gone public and no active exploitation has been confirmed as of this writing — but that’s a moving target, not a guarantee.</p>
<h2>A second, related issue</h2>
<p>Worth noting alongside this: WordPress core also patched CVE-2026-65640 (CVSS 8.8) in version 7.0.4. This one allows RCE through malicious PostScript file uploads, but only on sites running Imagick with Ghostscript, and only with Author-level access already in hand. It’s a narrower attack surface than the Elementor bug, but still worth closing off if your setup matches that configuration.</p>
<h2>What to actually do about it</h2>
<p>Updating to Elementor Pro 4.2.2 closes the hole, but it doesn’t clean up anything an attacker may have already dropped on your server before you patched. That’s the part people tend to miss.</p>
<p>If you’re running Elementor Pro, check <code>wp-content/uploads/elementor/forms/</code> for files that don’t belong — PHP files in particular. Do this even if you’ve already updated. Patching stops new attacks; it does nothing about a backdoor that’s already sitting there waiting.</p>
<p>Also worth checking: whether any of your forms actually need multiple file uploads enabled. If not, turning that off removes one of the two conditions needed for exploitation.</p>


A critical unauthenticated remote code execution vulnerability (CVE-2026-32475, CVSS 9.0) affected Elementor Pro's Forms module File Upload field, allowing attackers to bypass extension validation by submitting two file parts with one carrying an empty filename, tricking the plugin into moving a malicious PHP file into a public directory. Exploitation requires a published form with File Upload and multiple-file-upload enabled, then brute-forcing the filename generated via PHP's non-cryptographic uniqid(). The bug affects all versions up to 4.2.1 and was fixed in 4.2.2, released August 19, 2026, with Elementor patching it a day after being notified on July 16. A related but narrower WordPress core RCE (CVE-2026-65640, CVSS 8.8) was also patched in version 7.0.4, requiring Imagick with Ghostscript and Author-level access. Site owners are urged to check wp-content/uploads/elementor/forms/ for planted PHP files even after patching, since updating alone doesn't remove existing backdoors.

WordPress 7.1 ships with collaboration features, new blocks and expanded image format support

<p>WordPress 7.1 landed August 19, timed to coincide with WordCamp US, and it’s a genuinely meaty release: collaboration features, styling overhauls, media upgrades, and a pile of developer-facing plumbing. But scroll past the changelog and you’ll notice the same theme running through all three write-ups covering it: the good stuff shipped, the exciting stuff got pushed to 7.2.</p>
<p>The headline additions are real. @mention notifications and inline notes finally bring proper collaboration to the editor, shareable revision links let you send someone a diff without screen-sharing, and you can now style hover and focus states plus do responsive block styling without touching CSS. There’s a redesigned image editor, new Tabs and Playlist blocks, and expanded format support for HEIC, AVIF, UltraHDR, and WebP. Under the hood, the editor is now fully iframed, jQuery UI bumped to 1.14.2, and there’s a new Abilities API aimed squarely at AI agent integration.</p>
<p>Gutenberg 23.8, the plugin release feeding into this, is where the performance story lives. List View got a serious rework: selecting all blocks on a 1,000-paragraph post dropped from 16.8 seconds to 0.4 seconds. That’s not a rounding error, that’s a fix for something that was genuinely painful. The empty canvas also stopped showing a placeholder appender and now renders an actual default block, which sounds minor until you remember how many support threads probably existed because of that one UX quirk.</p>
<p>Then there’s the Icon Registration API, and this is where the discourse gets interesting. Developers finally got wp_register_icon_collection() and wp_register_icon() to register custom SVG sets for the Icon block, plugging a hole left open since the Icon block shipped in 7.0. One tutorial walks through building a full restaurant icon plugin using a PHP enum for type safety, which is a nice pattern. But the same writeup is blunt about what’s missing: the SVG allowlist only covers svg, path, and polygon elements, stroke attributes get stripped entirely, and there’s still no editor component for using these icons anywhere outside the Icon block itself. That work is explicitly deferred to 7.2.</p>
<p>So the shape of the reaction, if you can call three feature rundowns a reaction, is cautious enthusiasm with an asterisk. Real-time collaboration and the</p>


WordPress 7.1 shipped on August 19, timed with WordCamp US, bringing collaboration features like @mention notifications, inline notes, and shareable revision links, plus responsive block styling, a redesigned image editor, new Tabs and Playlist blocks, expanded image format support (HEIC, AVIF, UltraHDR, WebP), a fully iframed editor, jQuery UI bumped to 1.14.2, and a new Abilities API for AI agent integration. Gutenberg 23.8 delivers major performance wins, including cutting List View select-all time from 16.8 seconds to 0.4 seconds on a 1,000-paragraph post. The new Icon Registration API (wp_register_icon_collection() and wp_register_icon()) lets developers register custom SVG icon sets, but the SVG allowlist is limited to svg, path, and polygon elements, stroke attributes are stripped, and there's still no editor component for using icons outside the Icon block—that work is deferred to version 7.2.

Laravel 13.26 ships read-through filesystem driver, debounced listeners and Queue::forward()

Laravel 13.26.0 shipped on August 18, 2026 with a read-through filesystem driver that layers a primary disk over a fallback and promotes files to primary on first read (with a no-copy option for dev environments). The #[DebounceFor] attribute now works on queued event listeners, letting only the last dispatch in a window run the handler. A new Queue::forward() method reroutes a queue to another queue and/or connection without touching job classes or dispatch sites. Process pools and results are now iterable, a dedicated ProcessIdleTimedOutException distinguishes idle timeouts from regular timeouts, and Process fake gained assertRanCount/assertRanInOrder/recorded() helpers. Eloquent gets orWhereKey(), closure support in wherePivot(), and enum support in inOrderOf(). A JobReleased event covers releases from overlap middleware, workers print notices when a consumed queue pauses or resumes, Guzzle 8 is now supported, and a batch of Redis cluster fixes landed. Upgrade notes flag a LogicException when combining DebounceFor with ShouldBeUnique, and internal changes to whereKey()/whereKeyNot() that matter only if the Eloquent builder is extended.

Laravel 13.26 ships lazy filesystem migration driver with a file resurrection bug

<p>Taylor Otwell shipped a Turbopuffer driver for Scout last week. This week, at Aaron Francis’s suggestion, he shipped something more broadly useful: a “read-through” filesystem driver for Laravel 13.26. His own framing was casual: “Really useful for graceful filesystem migrations. What’s next week?” But the write-ups that followed dug into what makes this actually clever, and where it bites.</p>
<p>The core idea: pair a primary disk with a fallback disk. Reads check primary first, fall back to the old store if missing, and quietly copy the file into primary on the way through. Writes, deletes, and directory listings only ever touch primary. The upshot is that migrating from, say, an old S3 bucket to R2 stops being an all-or-nothing bulk sync. Hot files migrate themselves the first time someone touches them. Cold files just sit in the old bucket until you’re ready to deal with them, or never, if nobody ever needs them again.</p>
<p>That’s the pitch, and it’s a good one for anyone who’s sweated through a multi-terabyte bucket migration with strict downtime windows. But the deeper analysis pieces flag a genuinely weird edge case: because deletes only hit primary, deleting a file that’s already been promoted doesn’t actually kill it. The fallback disk still has the old copy, so the very next read resurrects it from the legacy store and re-promotes it to primary. A file you thought you deleted just comes back from the dead.  That’s the kind of bug you find in production at 2am, not in a demo.</p>
<p>The write-ups also cover the less glamorous but equally important stuff: promotion can be best-effort or strict depending on how much you trust the failure mode, large files get streamed rather than loaded into memory, and metadata handling has its own caveats worth reading before you rely on it. There’s also a <code>copy=&gt;false</code> option from a separate PR that lets you read through the fallback without promoting anything, handy for local dev environments seeded from a production snapshot where you don’t want your laptop slowly hoovering up the entire bucket.</p>
<p>Worth noting this isn’t solving a new problem. Cloudflare’s Sippy, Rclone, AWS DataSync, and Backblaze’s Super Slurper already do bucket-to-bucket migration. What’s different here is that Laravel’s version lives inside your app’s existing filesystem abstraction, so you don’t need a separate migration tool running alongside your deploy. Whether that convenience is worth the delete-resurrection footgun is going to depend entirely on how careful your team is about reading the docs before flipping the switch.</p>


Laravel 13.26 ships a new read-through filesystem driver that pairs a primary disk with a fallback disk, letting apps migrate storage backends (like S3 to R2) gradually instead of via a bulk sync: reads fall back to the old store and promote files to primary, while writes and deletes only touch primary. Analysis pieces following the release surface a nasty edge case: deleting a promoted file doesn't remove it from the fallback disk, so the next read resurrects and re-promotes it. Other details covered include best-effort vs strict promotion modes, streaming for large files, metadata caveats, and a copy=>false option for read-only access useful in local dev seeded from production snapshots.

StopAndProtect campaign uses 2,000 hacked WordPress sites to hit 6,000+ victims

<p>Check Point Research has spent the past several months untangling a malware campaign called StopAndProtect, and honestly, the operators’ own sloppiness is what made this whole thing crackable. Instead of paying for dedicated command-and-control servers like most operations do, they hijacked nearly 2,000 WordPress sites and used those as the backbone of their infrastructure. Cheap, distributed, and — it turns out — full of holes they never bothered to patch on their end either.</p>
<h2>How victims get hit</h2>
<p>The entry point is a ClickFix-style fake CAPTCHA. You’ve probably seen the pattern before: a page tells you to verify you’re human, except “verifying” means copying a command and pasting it into Windows Run or PowerShell. People do it because it feels like a normal security step, not a red flag. Once that PowerShell command runs, it kicks off a multi-stage .NET infection chain that pulls down several components:</p>
<ul>
<li><strong>SilentEncryptor</strong>, the ransomware payload</li>
<li><strong>SilentDataCollector</strong>, which steals credentials and other data</li>
<li>A lockscreen module</li>
<li>An SMB/USB worm for spreading across networks and removable drives</li>
<li>A VBS-based spreader</li>
<li>A custom chat utility, apparently used to communicate with victims</li>
</ul>
<p>What’s notable is that the malware doesn’t always encrypt files. Depending on what the operators want out of a particular victim, it can quietly exfiltrate data instead, or do both. There’s also a screen-capture feature and, oddly, a WhatsApp automation component baked into the toolkit.</p>
<h2>Running the show through WordPress</h2>
<p>To manage all of this at scale, the group built a Visual Basic 6 desktop tool paired with custom PHP web shells planted on the compromised sites. Many of these WordPress installs were running old, unpatched versions with dozens of known vulnerabilities — plus malicious</p>


Check Point Research uncovered a malware operation dubbed StopAndProtect that hijacked nearly 2,000 compromised, unpatched WordPress sites to serve as its command-and-control backbone instead of paying for dedicated infrastructure. Victims are lured through a ClickFix-style fake CAPTCHA that tricks them into pasting a PowerShell command, triggering a multi-stage .NET infection chain delivering ransomware (SilentEncryptor), an infostealer (SilentDataCollector), a lockscreen, SMB/USB and VBS worms, a victim chat tool, screen capture, and even WhatsApp automation. Operators manage the campaign via a custom Visual Basic 6 desktop tool and PHP web shells planted on the hacked sites.

NativePHP v4 compiles Blade components into native SwiftUI and Jetpack Compose views

NativePHP v4 introduces SuperNative, a rendering mode that compiles Blade components directly into real SwiftUI views on iOS and Jetpack Compose views on Android, with no web view or HTML involved. Screens are now PHP classes extending NativeComponent paired with Blade templates using native elements styled by Tailwind classes. PHP and native code share memory directly, eliminating bridge round-trips, and accessibility features like VoiceOver and TalkBack work natively. Web views remain supported as an embeddable component for screens not yet converted. A new Pest testing suite lets developers test native screens without a device using a FakeBridge. The only breaking change in v4 is that four plugins (Device, Dialog, File, System) are now folded into core, requiring their standalone packages to be uninstalled before upgrading. Version 4.1, released August 7, added the #[Locked] attribute, TreeObservers for debugging, and Tailwind class validation warnings.

Symfony releases official LSP server with Twig, YAML and DI-aware tooling

Symfony has released an official Language Server Protocol implementation called Symfony Language Tools, bringing Symfony-aware autocompletion, hover info, navigation, rename support, diagnostics and quick fixes to PHP, Twig and YAML files. It ships as a native VS Code extension and works out of the box with Neovim, plus standalone binaries for any LSP-capable editor. It understands routing, dependency injection, Twig, translations, env vars, Messenger, Security, forms, Doctrine and more, and boots the app kernel in debug mode to read runtime metadata for accuracy rather than guessing from source alone. Most of the code was written and reviewed by AI models (Claude and GPT), directed by Fabien Potencier. The tool is currently an experimental beta.

Laravel 13.25 adds global queue pausing and new artisan dev terminal UI

<p>Laravel 13.25 landed on August 11, 2026, and it’s a bigger release than you’d expect for a routine weekly version bump. Two changes stand out: a way to pause every queue at once, and a completely new terminal experience for <code>php artisan dev</code>.</p>
<h2>Pause everything, all at once</h2>
<p>Until now, pausing queues meant pausing them one at a time. <code>queue:pause --all</code> and <code>queue:resume --all</code> fix that, backed by matching <code>Queue::pauseAll()</code> and <code>Queue::resumeAll()</code> facade methods. Run it, and every worker on every connection stops picking up new jobs.</p>
<p>This isn’t the same as maintenance mode. Jobs that are already running get to finish. Dispatchers can still write new jobs to the queue; they just sit there until you resume. It’s exactly what you want during a deploy: stop new work from starting, let existing work wrap up cleanly, then flip it back on.</p>
<p>Under the hood, it’s a single forever-cached key checked alongside the per-queue pause and restart signals that already existed, so there’s no real overhead added. Worth noting: the global pause and individual queue pauses don’t interact. If you paused one specific queue by hand, calling <code>resumeAll()</code> won’t undo that. They’re tracked independently. Two new events, <code>QueuesPaused</code> and <code>QueuesResumed</code>, fire alongside the existing per-queue equivalents, so you can hook into either level.</p>
<h2>A real terminal UI for <code>artisan dev</code></h2>
<p>The other big change: <code>artisan dev</code> no longer runs on <code>concurrently</code>. It’s now powered by <code>@laravel/multiplex</code>, a first-party terminal UI package (currently sitting at v0.4.1) that the Laravel team says can be reused outside of this command too — which makes me think we’ll see more first-party terminal tooling from them going forward.</p>
<p>Instead of one interleaved stream where your dev server, queue worker, Pail logs, and Vite output all fight for the same lines, each process gets its own tab. There are three display modes — tabs, stream, and inline — plus per-process restart, log search, timestamps, and configurable buffer sizes through new <code>DevCommands</code> methods. Real-time log tailing runs through the existing <code>artisan pail</code> package.</p>
<p>One behavior change worth flagging: crashed processes now auto-restart by default. Previously, one process failing would kill the others. That’s gone. There’s also a quieter fix bundled in here that restores respect for the <code>SERVER_HOST</code> environment variable, which had silently stopped working.</p>
<p>The catch: multiplex needs macOS or Linux and Node v22.13+. If you’re on Windows, you’re still on <code>concurrently</code> for now.</p>
<h2>Everything else in the release</h2>
<p>A handful of smaller additions rounded out 13.25:</p>
<ul>
<li>Image instances can now be returned directly from routes via <code>Responsable</code>, and there’s a new <code>Image::fromStream()</code> plus a public <code>toFormat()</code>.</li>
<li>A <code>UniqueJobSkipped</code> event and a <code>$timeout</code> property on <code>JobTimedOut</code>.</li>
<li>Fail-on-timeout support for notifications.</li>
<li><code>withoutCookies()</code> for expiring multiple cookies in one call.</li>
<li>A <code>foreignUlidFor()</code> schema helper.</li>
<li><code>Request::all()</code> now prefers input values over files when field names collide.</li>
</ul>
<p>Plus the usual pile of bug fixes. For a weekly point release, this one’s got a surprising amount packed in — the queue pausing alone is the kind of thing that quietly saves someone a bad deploy night.</p>


Laravel 13.25, released August 11, 2026, ships a heavier-than-usual point release. The headline feature replaces the concurrently-based artisan dev command with @laravel/multiplex, a new terminal UI offering tabs, stream, and inline view modes, per-process restart, log search, and auto-restart on crash (requires macOS/Linux and Node v22.13+; Windows keeps the old setup). It also adds a global queue:pause/resume --all command and matching Queue facade methods, plus smaller additions: Image::fromStream() and Responsable support, a UniqueJobSkipped event, a JobTimedOut $timeout property, withoutCookies(), foreignUlidFor(), a fix restoring respect for SERVER_HOST, and a tiebreaker change making Request::all() prefer input over files on name collisions.

Mercure 1.0 alpha ships with IETF Internet-Draft protocol and OAuth 2.0 authorization

Mercure 1.0 alpha is the biggest release in the project's history, modernizing its real-time Server-Sent Events protocol with three major changes: topic matching now uses the WHATWG URL Pattern standard (replacing URI Templates), authorization is fully aligned with OAuth 2.0 using RFC 9068 access tokens with authorization_details claims, and the protocol has been rewritten as an IETF Internet-Draft. The release includes a rebuilt UI debugger split into a production-safe debugger and a dev-only playground, hardened security defaults (no tokens in URLs, explicit algorithm allowlists, hard errors on unknown directives), and a new CLI for minting tokens. A compatibility mode (`protocol_version_compatibility 8`) lets existing 0.x clients connect to a 1.0 hub without changes. PHP ecosystem integrations via FrankenPHP, Symfony, and API Platform have been updated. The hub is still a custom Caddy build with HTTP/3, automatic TLS, Prometheus metrics, and OpenTelemetry support.

BdThemes supply chain hack creates rogue WordPress admins across 100,000+ installs

A threat actor compromised BdThemes' upstream infrastructure, poisoning a remote JSON feed used by the Biggop Library to deliver promotional banners in WordPress admin dashboards. By exploiting an XSS vulnerability introduced in March 2026 in the JSON response-parsing code, attackers injected malicious JavaScript that used authenticated admin sessions to create rogue administrator accounts. A secondary payload (w2.js) installed a fake plugin containing a webshell (emer-run.php) for persistence. The attack is entirely API-driven, requires no user interaction or plugin update, and the rogue accounts are hidden from the WordPress user list. Attacks were first detected on August 7, with the campaign potentially starting as early as June 23. All affected BdThemes plugins — including Element Pack (100,000+ installs), Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit — were pulled from WordPress.org on August 8. The XSS vulnerability remains unpatched. The C2 infrastructure links this attacker to previous supply-chain compromises of Advanced Responsive Video Embedder and OptinMonster.