Security advisories

PHP security advisories

Every published advisory for PHP and the frameworks, CMSs and packages built on it, in one place. Updated automatically as projects publish them.

Needs attention

Recent advisories that affect versions still getting security fixes. If you run one, update now.

critical Laravel · Oct 23, 2026 · Reviewed Oct 31

Laravel TokenGuard: Log In as Any User Without Their API Token

Lets an unauthenticated attacker log in as another user in Laravel apps that use the token auth guard with MySQL or MariaDB.

Fixed in 13.29.0 and 12.68.0

Reference

Older advisories with settled guidance. That doesn't mean your app is patched: check your version on each tool's page.

critical Drupal · May 20, 2026 · Reviewed Nov 3

Drupal Core: SQL Injection

Allows SQL injection in Drupal core from 8.9.0 up to the fixed 10.4, 10.5, 10.6, 11.1, 11.2 and 11.3 releases.

Fixed in 11.3.10 and 10.6.9 · 4 older releases
critical Symfony Twig · May 20, 2026 · Reviewed Nov 4

Twig: Code Execution Through a Crafted {% use %} Template Name

Lets anyone who can write a template, even a sandboxed one, run PHP code on the server through the {% use %} tag.

Fixed in 3.26.0
critical Laravel Reverb · Jan 21, 2026 · Reviewed Nov 7

Laravel Reverb: Remote Code Execution Through Redis When Scaling Is Enabled

Allows remote code execution in Reverb apps with REVERB_SCALING_ENABLED=true by anyone who can publish to the Redis server Reverb uses.

Fixed in 1.7.0
critical Drupal · Sep 28, 2023 · Reviewed Nov 10

Drupal JSON:API: Cached Error Backtraces Can Expose Data to Anonymous Users

Can cache error backtraces with sensitive data and serve them to anonymous users on Drupal sites with the JSON:API module enabled.

Only affects branches that no longer get security fixes
critical Drupal · Apr 26, 2023

Access bypass in Drupal core

Only affects branches that no longer get security fixes
critical Laravel · May 14, 2022

Laravel Framework Deserialization Vulnerability

Only affects branches that no longer get security fixes
critical Drupal · Apr 22, 2022

Drupal SQL Injection vulnerability

No fixed release listed yet
critical Drupal · Feb 12, 2022

Unrestricted Upload of File with Dangerous Type in Drupal core

Only affects branches that no longer get security fixes
critical Doctrine · Nov 11, 2021

SQL Injection in Limit Clause Generation API

Fixed in 3.1.4 · 1 older release
critical Doctrine · Apr 6, 2021

Regression in Query Parenthesis can have Security Implications

Fixed in 2.8.4

Every advisory is on its tool's page ↓

Tools we track

One page per project, with its supported branches, a version check and every advisory.