Dhavalkumar Mesavaniya

Founder, JIGOMIT. Fixed-price Laravel upgrades (Laravel 5→13, PHP 7→8.4) and care plans for UK & EU businesses. Free 24-hour composer audit ↓

[Dhavalkumar Mesavaniya @dhavalm48]

PHP 8.2 security fixes end on 31 December.

"php": "^8.2" in composer.json is the oldest version your app allows, not what the server runs.

Check the real one: php -v on the production box.

On Laravel 11 or 12, moving to PHP 8.4 rarely needs a framework upgrade.

[Dhavalkumar Mesavaniya @dhavalm48]

Laravel 8 supports PHP 7.3 to 8.1. Last week's PHP2Shell fixes shipped as releases only for 8.2 to 8.5; 8.1 and older got source backports, no release. So a Laravel 8 app usually needs PHP and the framework moved together, not one at a time.

[Dhavalkumar Mesavaniya @dhavalm48]

@laravelshift Worth adding the runtime side: Laravel's support table lists PHP 7.3 to 8.1 for Laravel 8, and 8.1 got no official PHP2Shell release this week, only source patches. So those apps usually need PHP moved too, not just the framework.

[Dhavalkumar Mesavaniya @dhavalm48]

@laravelnews @paulredmond One gap worth adding: queued jobs. A job dispatched right after the write runs on a worker with a fresh connection, so it can read the replica before it catches up. Inside the job, Model::onWriteConnection()->find($id) reads from the primary.

[Dhavalkumar Mesavaniya @dhavalm48]

@UpwindMDR Worth adding: only apps on the built-in "driver" => "token" guard are exposed, not Sanctum or Passport. And Laravel 11 and older get no fix, since 11 stopped getting security patches on 12 March, so there it is an upgrade or a move off that guard.

[Dhavalkumar Mesavaniya @dhavalm48]

@PovilasKorop Pairs well with json_validate() from PHP 8.3 when you only need a yes or no: it checks the string without building the array, so big payloads cost less memory. One catch: with JSON_THROW_ON_ERROR, json_last_error() isn't updated, so don't mix the two styles.

[Dhavalkumar Mesavaniya @dhavalm48]

@PovilasKorop If a box can't be patched today, AWS has published a WAF rule for PHP2Shell, worth switching on as a stopgap. It only filters known request shapes. With attempts seen before disclosure: patch, restart FPM, then look for PHP files you didn't put there.

[Dhavalkumar Mesavaniya @dhavalm48]

@PovilasKorop And the ones that only think they're patched: php -v on the CLI can show the new version while PHP-FPM keeps serving the old build until every pool is restarted. Containers stay on the old PHP until the image is rebuilt and redeployed.

[Dhavalkumar Mesavaniya @dhavalm48]

PHP shipped fixes today for two critical remote code execution flaws, each scored 9.2: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older got no release, only minimal source backports for 7.4 to 8.1 or a vendor patch. Check php -v on the server, not composer.json.

[Dhavalkumar Mesavaniya @dhavalm48]

@Sir_Mishaa @brankopetric00 Update: you were right, and I was wrong to say 8.1 and older get nothing. No official release for them, but the PHP security team published minimal source backports for 7.4, 8.0 and 8.1, and vendors backport too. Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

[Dhavalkumar Mesavaniya @dhavalm48]

@SaNedaPrihlasit @Sir_Mishaa @brankopetric00 That fits: hosts and distros like CloudLinux, Debian and RHEL backport fixes into their own PHP 5 and 7 builds, even where upstream ships none. Worth asking them which build or package version carries the fix, and checking PHP-FPM was restarted.

[Dhavalkumar Mesavaniya @dhavalm48]

What to do on Laravel 11 or older, plus a five-minute check: https://t.co/K63UfShqpF

[Dhavalkumar Mesavaniya @dhavalm48]

Critical Laravel advisory GHSA-f9x3-7vq9-cph6 (9.2): token guard auth bypass on MySQL/MariaDB.

Fixed in 12.68.0 and 13.29.0. Laravel 11 and older get no patch.

Check config/auth.php for "driver" => "token".

[Dhavalkumar Mesavaniya @dhavalm48]

@PovilasKorop The difference I notice in rescues: with older human code someone usually remembers why it was built that way. With generated code nobody does, so the first urgent issue starts with reading it cold. Tests end up being its only memory.

[Dhavalkumar Mesavaniya @dhavalm48]

@catatsumurii @PovilasKorop A hand edit in vendor/ is gone on the next composer install. If you patch, do it with cweagans/composer-patches so it survives deploys, and treat it as a bridge: the next advisory will need the same again.

[Dhavalkumar Mesavaniya @dhavalm48]

@laravelnews @paulredmond For anyone on Laravel 11 or older: the advisory has no patched release below 12.68.0, and 11 has been out of security support since March. Search config/auth.php for "driver" => "token" to see if you are exposed.

[Dhavalkumar Mesavaniya @dhavalm48]

Dates, what forces the move (insurers, Cyber Essentials, hosts) and how to check: https://t.co/D64hEWbLtD

[Dhavalkumar Mesavaniya @dhavalm48]

PHP 8.2 security fixes end on 31 December.

"php": "^8.2" in composer.json is the oldest version your app allows, not what the server runs.

Check the real one: php -v on the production box.

On Laravel 11 or 12, moving to PHP 8.4 rarely needs a framework upgrade.