Laravel apps need a PHP rebuild, not a composer update.
These flaws are in the PHP interpreter, not in your vendor folder. Every place your app runs, from web servers to queue workers and containers, has to be rebuilt or upgraded to a patched PHP release.
Is the PHP Laravel runs on affected?
Run php -v on the server. A patched version on disk only protects you after every PHP worker restarts. Distro packages can carry backported fixes under older version numbers, so we confirm against your vendor's changelog.
What makes these sites a target.
Long-lived workers keep old code loaded
Octane on Swoole, RoadRunner or FrankenPHP, Horizon and queue workers stay alive for hours. They keep the vulnerable code in memory until they restart.
Container images pin old PHP
A Dockerfile built on an old php:8.x-fpm tag stays vulnerable until the image is rebuilt and redeployed.
APIs accept large request bodies
File uploads, multipart APIs and webhooks are the kinds of requests these exploits use.
Older apps are stuck on 8.1
Laravel 10 apps often run on PHP 8.1, which gets no patch. Laravel 11 and later need PHP 8.2 or newer.
How we fix it on Laravel.
The first commands we run, read-only:
php artisan about # Laravel and PHP versions docker image ls | grep -i php php artisan queue:restart # after the upgrade
Inventory
We map every runtime: web, queue, scheduler, Octane, CI images and serverless layers, with their PHP versions.
Rebuild
We bump base images and runtimes to patched releases, update composer platform settings, and run your test suite.
Roll out and restart
We deploy, restart workers with queue:restart and octane:reload, and cycle pods so no old process survives.
Harden and verify
We add request size limits and edge rules at your load balancer, and confirm the PHP version every process reports.
Any cloud, any VPS, any server.
The fix is the same everywhere: a patched PHP build, restarted workers and hardened settings. We work on VMs, containers, Kubernetes, serverless runtimes and control-panel hosting.
Pick how much you want us to do.
Exposure check
- Every PHP version and server you run, listed
- Clear verdict: exposed or not, and how urgent
- Written report with next steps
Fixed fee, credited toward remediation
Guided remediation
- Upgrade plan for your platform and hosting
- Temporary hardening while you wait
- Edge and WAF rules written for your routes
- We review your team's work and verify it
Hourly or fixed package
Full repair and upgrade
- Staging test, upgrade and rollback plan
- Patched PHP on every server and container
- All workers restarted and verified
- Hardening, monitoring and a closing report
Fixed quote per environment
Patch watch
- We track PHP and platform advisories
- Quarterly version and config checks
- Priority response for the next critical CVE
Monthly retainer
From first call to verified fix.
Authorize
You sign a short scope and authorization. We don't scan or touch any system without it.
Inventory
We record every PHP version, server, container and worker process in scope.
Plan
You get a fixed quote, a schedule and a rollback plan before any change.
Patch and restart
We upgrade PHP and restart every worker so no vulnerable code stays in memory.
Verify
We confirm the fix on every host and hand over a written report.
Don't restart the server yet.
If you see shells or tools like curl launched by PHP processes, PHPSESSID cookies longer than 256 bytes, or a spike in PHP worker crashes, contact us before you patch. Restarting wipes the memory evidence that shows what an attacker did. We preserve that evidence first, then work with an incident response firm if the investigation needs one.
Laravel questions.
We deploy with Forge. What changes?
We install the patched PHP release on each server, switch the site to it, and restart PHP-FPM and your daemons.
We run on Vapor or Lambda.
Serverless runtimes get updated by redeploying on a patched runtime version. We check which version each function uses.
Do you touch application code?
Only when moving off PHP 8.1 needs it. We'll show you each code change before we make it.
Find out where you stand this week.
Tell us what you run on Laravel and where it's hosted. We'll reply within one business day with a time for the exposure check.
Include your platform, approximate number of sites or servers, and your hosting provider.