Awais Dev

Awais Dev Basically a laravel artist

Your Laravel API might accept a login that was never a real token. 🚨CVE-2026-114509: a critical authentication bypass (C...
24/10/2026

Your Laravel API might accept a login that was never a real token. 🚨

CVE-2026-114509: a critical authentication bypass (CVSS 9.2) in Laravel's built-in TokenGuard, the classic token driver behind auth:api. Laravel published the advisory on October 19, and a public proof of concept is already out.

The guard checked only that a token was not empty. A crafted array in a JSON request slips through, the user provider turns it into a WHERE IN lookup, and MySQL or MariaDB compare the token column as numbers. Most stored tokens cast to 0, so the database hands back the first matching user. No valid token needed. Account takeover on any route behind that guard.

You are affected if all three are true: a token driver guard in config/auth.php, users on MySQL or MariaDB, and framework below 12.68.0 (12.x) or 13.29.0 (13.x). On Sanctum or Passport? Different guards, not this bug.

The advisory lists no workaround. The fix is the update.

Do this today:
1. Check config/auth.php for the token driver
2. composer update laravel/framework
3. Verify the running version with composer show
4. Cannot upgrade yet? Reject non-string api_token values, or move the API to Sanctum

Patch today.

24/10/2026

No token. No password. Logged in as someone else. 🚨

CVE-2026-114509 is a CVSS 9.2 auth bypass in Laravel's built-in TokenGuard. A crafted JSON array tricks the lookup, and MySQL or MariaDB match the wrong user.

Patched: 12.68.0 · 13.29.0
On Sanctum? This one is not yours.

Check config/auth.php. Patch today. Full breakdown in today's carousel.

22/10/2026

One request. No login. Full server. 🚨

PHP2Shell is a CVSS 9.2 remote code ex*****on bug inside PHP itself — clean Laravel code won't save you, only a PHP update will.

Patched: 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12
On PHP 8.1? No official fix exists.

Run php -v. Patch today. Full breakdown in today's carousel.

Your Laravel code can be perfect. Your server is still wide open. 🚨PHP2Shell: two remote code ex*****on bugs inside PHP ...
22/10/2026

Your Laravel code can be perfect. Your server is still wide open. 🚨

PHP2Shell: two remote code ex*****on bugs inside PHP itself (CVE-2026-109618 + CVE-2026-109619), both rated CVSS 9.2. Unauthenticated — one request is enough.

This is not a framework bug. The flaw is in how the PHP engine handles uploads, so composer update will not save you. The leaked exploit demo ran against Laravel 13.11, WordPress, Magento and Drupal.

Emergency patches dropped Oct 21: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12.

Still on PHP 8.1 or older? There is no official patch. Backport or upgrade — today, not next week.

Do this now:
1. php -v on every server (staging and cron boxes too)
2. Update PHP to a patched version
3. Restart PHP-FPM and verify the version changed

Attack traffic was already spotted before the patch even shipped. Patch today.

20/10/2026

Stop chasing forgotten with() calls. One line in AppServiceProvider makes Laravel batch every missing relation for you — 51 queries → 2. 🔥

51 queries for one page. One line fixes it. 🔥Your posts page ships with Post::with('author'), then someone adds the comm...
20/10/2026

51 queries for one page. One line fixes it. 🔥

Your posts page ships with Post::with('author'), then someone adds the comment count, forgets the with(), and the debug bar shows 51 queries again.

Laravel 12.8 shipped the switch most teams never turned on:

Model::automaticallyEagerLoadRelationships();

One line in AppServiceProvider::boot(). Touch a missing relation on any model and Laravel batches it for the whole collection — 51 queries become 2. Nested chains (users → posts → comments) go from 61 to 3.

Global is not your style? Opt in per query with ->withRelationshipAutoloading().

Caveat: $post->comments()->count() in a loop still fires per row. It catches what your with() list missed — it does not think for you.

Check your debug bar.

16/10/2026

Stop disguising searches as POST requests. Laravel 13.35 added Route::query() — GET semantics with a request body. 🔥

Follow for daily Laravel tips.

Your search endpoint shouldn't need a POST request just because the filters got complicated.GET /api/products?keyword=ru...
16/10/2026

Your search endpoint shouldn't need a POST request just because the filters got complicated.

GET /api/products?keyword=running+shoes starts clean. Add categories, brands, price range, stock, sorting... and suddenly your URL is 400 characters of encoded chaos.

So most of us do the POST hack: POST /api/products/search with a JSON body. Works fine, but semantically it's a lie. You're only READING data.

Laravel 13.35 fixed this properly: Route::query()

It registers the HTTP QUERY method. Safe and idempotent like GET, but carries a request body like POST. Filters travel as clean JSON. No URL monster.

Route::query('/products/search', SearchProductsController::class);

Heads up: CSRF treats QUERY like POST, so web routes need the token or an except entry. And this week's Wayfinder 0.1.22 + Precognition 2.1.1 bring typed client-side query() helpers.

Cleaner code, honest semantics. Follow for daily Laravel tips.

3 lines of code. That's all it takes to give your Laravel agent a team now.Laravel AI SDK 1.2 shipped last week, and the...
14/10/2026

3 lines of code. That's all it takes to give your Laravel agent a team now.

Laravel AI SDK 1.2 shipped last week, and the headline feature is sub-agents: your agent can now delegate to specialist agents, each running with its own clean context.

I put the 3 upgrades that actually matter into the carousel above:

1. Sub-agents. One agent per job: research, code, review. No more stuffing everything into one giant prompt and hoping.

2. Approval controls. The agent pauses before sensitive tools run. You review, then it ships. Human-in-the-loop, finally done right.

3. Agent skills. Reusable behavior packs that snap into any agent. Teach it once, use it everywhere.

The shift underneath all three is simple: less prompt babysitting, more team management.

I've been running agents in production for client work (my outreach pipeline runs on a 17-tool MCP server), and approval controls are the piece I was missing. An agent that can't pause is a liability. One that can is a hire.

Which of the three would you wire up first?

P.S. The short video version is attached too.

14/10/2026

Your Laravel app just hired an AI team.

AI SDK 1.2 brings sub-agents, approval controls, and agent skills — full breakdown in the carousel post.

Which upgrade ships first for you?

Address

Basti Roshan Deen Rabnawazpura
Bahawalnagar
62300

Website

Alerts

Be the first to know and let us send you an email when Awais Dev posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category