Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Laravel TokenGuard authentication bypass through non-string API credentials

Fix availableCritical · CVSS 9.2EPSS 0.40%

Published Oct 23, 2026 · updated Oct 23, 2026

What to do

  1. Upgrade to a fixed version: laravel/framework 13.29.0, laravel/framework 12.68.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Composerlaravel/framework

Vulnerable versions
>= 13.0.0, < 13.29.0
Fixed in
13.29.0

Check your project: composer show laravel/framework

Composerlaravel/framework

Vulnerable versions
< 12.68.0
Fixed in
12.68.0

Check your project: composer show laravel/framework

What changed

  1. Oct 23, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-287 Improper Authentication · CWE-1287 Improper Validation of Specified Type of Input

← All critical vulnerabilities