php

The PHP security team says a release due October 21 at 14:00 UTC fixes two critical vulnerabilities, both CVSS v4.0 9.2, and urges users to prepare to upgrade.

Socket found malicious code in dev branches of a 700,000-download Laravel Nova package on Packagist, tying the compromise to its ongoing PolinRider campaign.

PHP 8.6.0 Beta 3 landed with a native clamp() function, a SortDirection enum, and a trim() whitespace fix, as the release heads toward a November 19 GA.

After a six-month community process and unanimous vote, the PHP Group has retired the PHP License 3.01 and Zend Engine License in favor of the widely recognized BSD 3-Clause.

Attackers rewrote Git tags across four Laravel localization packages to point to malicious forks, poisoning hundreds of versions and deploying a credential stealer targeting cloud keys, SSH, and crypto wallets.