For owners of applications on Laravel 5, 6, 7 or 8

Your Laravel app and the October 2026 PHP vulnerabilities

Published 23 October 2026 · keepPhpUp · Sources: PHP advisories of 21 October, Laravel Forge advisory, Laravel upgrade guides 6.x through 13.x

Laravel is not the problem. The PHP version your Laravel version forces you to run is. This page explains the link and the way out.

The short version

On 21 October PHP fixed two critical, unauthenticated remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, for PHP 8.2 and newer only. Older PHP got a source-level patch at best, and nothing at all below 7.4. The full explanation is here.

Each Laravel release supports a range of PHP versions. The older your Laravel, the older the newest PHP it will run on, and for Laravel 5 through 8 that ceiling sits at or below the versions that did not get a package fix.

Where each Laravel version leaves you

LaravelNewest PHP it runs onLaravel security fixesYour position today
5.x7.3 or 7.4 depending on minorEnded 2020 or earlierLikely on PHP 7.x; at best a source patch exists for PHP, nothing for the framework
6.x8.0Ended Sep 2022PHP source patch only; framework unpatched
7.x8.0Ended Mar 2021Same as above
8.x8.1Ended Jan 2023PHP 8.1 has a source patch only; framework unpatched
9.x8.2Ended Feb 2024You can install the PHP 8.2 fix, but the framework itself gets no fixes
10.x8.3Ended Feb 2025PHP fixable; framework not
11.x8.4Ended Sep 2025PHP fixable; framework not
12.x8.4Until Feb 2027Patch PHP now; plan the move to 13 before February
13.x8.5Until Q1 2028Patch PHP now; you are current

PHP ceilings are from each release's published requirements; a few point releases allow one version higher. The table is accurate for the choice in front of you: anything on Laravel 8 or older cannot get a package fix for these two bugs without first moving the framework.

Why "just upgrade PHP" does not work on old Laravel

Laravel 5 to 8 depend on libraries that stop working on newer PHP, and on language features PHP removed. Put Laravel 6 on PHP 8.2 and it fails to boot. So the PHP upgrade and the framework upgrade are one job, done one release at a time following Laravel's own upgrade guides. For a typical application that is six or seven releases, each with a known list of changes, which is why the work can be priced before it starts.

What the work looks like, honestly

  1. Tests first. Before anything changes, a test suite is written that pins what the application does today, including its quirks, and runs on the current PHP. For a mid-sized app that is a hundred or so tests and about a week.
  2. One release at a time. Each Laravel step is its own set of changes and its own pull request with the suite green. Abandoned packages are replaced along the way; the old form helper, the old PDF engine, the old mailer, the old proxy package are the usual ones.
  3. Integrations verified. Payments run against the provider's test mode after every step. Emails and PDFs are compared to snapshots. Queued jobs are drained before cutover.
  4. Cutover on your date. Staging with a copy of your data, your people clicking through their day, a rehearsed rollback, then production. Thirty days of watch after.

Two worked examples, with real numbers: a small Laravel 7 back end quoted at ,500 over eight days, and a Laravel 6 ticketing platform with Stripe and PDF tickets quoted at ,000 over six weeks.

If you are on Laravel 12 or 13, patch PHP today using your host's package source; Forge users must do it per server because automatic security updates do not cover PHP. Then put the Laravel 13 move on the calendar before February.

On Laravel 8 or older?

Start with the 48-hour exposure check, $750, credited against the migration. You get your real position in writing and a fixed quote for the move.

Email us your Laravel and PHP versions Run the free check first