Security

Laravel Lang Supply Chain Advisory

Snyk's security advisory detailing a supply chain vulnerability discovered in the Laravel Lang package ecosystem, explaining the attack vector and providing guidance for Laravel developers to protect their applications.

An Update on Composer & Packagist Supply Chain Security

Packagist outlines their comprehensive supply chain security roadmap following recent attacks, including integrated malware detection with Aikido, immutable stable versions launching this week, and plans for mandatory MFA and SLSA build provenance.

50,000 Spam Emails and a 3 AM Panic: What Happened When I Forgot About a Side Project

A cautionary tale of how an outdated Livewire vulnerability in a forgotten side project led to 50,000 spam emails being sent, and how Docker containerisation limited the damage. Daniel shares the full story of discovering the breach, the panicked overnight investigation, and the lessons learnt about security and updating dependencies.

In Depth: Don't Trust Public Livewire Properties

An in-depth security analysis exploring how Laravel Livewire's public properties can be manipulated by malicious users through browser JavaScript, even when input fields are removed. This tutorial demonstrates the vulnerability with practical examples and explains why developers should never trust client-side data in Livewire components.

Axios Was Compromised: What Laravel Developers Should Check

A comprehensive security alert explaining how the Axios npm package compromise on March 31, 2026 could affect Laravel applications using modern frontend tooling. The post provides practical steps to check if your Laravel projects were impacted and includes specific commands to search lockfiles for the malicious package versions.

Security Tip: Your JWT Might Be a Forever Key!

A crucial security warning about JWT tokens without expiration dates that can become permanent access keys, even after users leave or credentials are compromised. Learn why setting proper expiration times is essential for Laravel applications using JWT authentication.

Security Tip: Validate Config at Boot

Learn why validating critical configuration values in your service provider's boot method is superior to checking them in controllers or middleware. This security-focused tutorial shows how to catch configuration issues early in your Laravel application lifecycle, preventing deployment failures and protecting users from unexpected errors.