Blog

Security 15 min read

Laravel Security Checklist 2026: 25 Checks Before You Ship to Production

A practical security checklist for Laravel developers. Covers .env protection, debug mode, session cookies, CORS, CSRF, security headers, dependency audits, and more. Copy this list into your deployment workflow.

Matt King

April 15, 2026

Security 12 min read

Laravel File Upload Security: Preventing Remote Code Execution Through Unrestricted Uploads

File uploads are one of the most dangerous features in any Laravel application. A single misconfiguration can let an attacker upload a PHP shell and take full control of your server. Here is how to lock it down properly.

Matt King

April 14, 2026

Security 11 min read

Subdomain Takeover: How Dangling DNS Records Put Your Laravel App at Risk

Dangling DNS records are one of the most overlooked attack vectors in Laravel deployments. Learn how subdomain takeover works, why deprovisioned cloud resources create exploitable gaps, and how to protect your application.

Matt King

April 7, 2026

Security 10 min read

CORS Misconfigurations in Laravel: Wildcard Origins, Reflected Headers & How to Fix config/cors.php

Your Laravel CORS policy might be letting any website read your API responses. Learn how wildcard origins with credentials, reflected Origin headers, and permissive config/cors.php defaults create security holes, with exact fixes for each.

Matt King

March 31, 2026

Security 12 min read

The OWASP Top 10 Just Changed. Here Is What It Means for Laravel Teams.

The OWASP Top 10 2025 added supply chain failures at #3 and error handling at #10, while injection dropped to #5. Here is the full updated list and what Laravel developers need to do differently.

Matt King

March 24, 2026

Security 12 min read

NIST DNS Security Update (SP 800-81r3): 6 Changes That Affect Your Infrastructure

The first DNS security update from NIST since 2013 changes how you should handle Protective DNS, encrypted DNS, DNSSEC, and dangling records. Here are the 6 key changes and what to do about each one.

Matt King

March 23, 2026

Security 10 min read

Your Laravel APP_KEY Is Probably on GitHub. Here Is Why That Means RCE.

GitGuardian found 260,000 exposed Laravel APP_KEYs on GitHub. With the right key, attackers can achieve remote code execution on your server in seconds. Here is how the attack works and how to protect yourself.

Matt King

March 19, 2026

Vulnerability 8 min read

CVE-2025-54068: Critical Livewire RCE Vulnerability in Laravel (How to Fix)

CVE-2025-54068 is a critical remote code execution vulnerability in Livewire v3 that allows unauthenticated attackers to execute arbitrary code on your server. With 130,000+ applications affected, here is how to check if you are vulnerable and patch it.

Matt King

March 19, 2026

Security 8 min read

Fake Laravel Packages on Packagist Are Installing Backdoors. Here Is How to Check.

Three malicious Packagist packages disguised as Laravel utilities deploy a cross-platform RAT that gives attackers full shell access, reads your .env, and exfiltrates credentials. Here is what happened, how to check if you are affected, and what to do.

Matt King

March 16, 2026

Security 8 min read

GitLab 2FA Bypass (CVE-2026-0723): What Happened and How to Protect Yourself

GitLab patched a high-severity two-factor authentication bypass (CVE-2026-0723, CVSS 7.4) that lets attackers hijack accounts. Here is what the vulnerability is, who is affected, and how to remediate it.

Matt King

March 12, 2026

Security 10 min read

AI Is Writing Your Laravel Code. Who Is Checking Its Security?

Laravel's AI SDK, Boost, and tools like Cursor and Claude Code are changing how we build applications. But over 40% of AI-generated code contains security flaws. Here is how to ship faster without opening the door to attackers.

Matt King

March 12, 2026

Security 15 min read

The Complete Laravel Security Checklist for 2026

A comprehensive, 30-point security checklist covering every layer of your Laravel application. From .env protection and security headers to debug mode detection and DNS security.

Matt King

March 11, 2026

Security 10 min read

What Is External Attack Surface Management (EASM)?

External Attack Surface Management continuously discovers and monitors your internet-facing assets for security risks. Learn how EASM differs from DAST, SAST, and pentesting, and why every team shipping web apps needs it.

Matt King

March 11, 2026

Security 18 min read

How to Secure a Laravel Application: The Definitive Guide

A practical, code-heavy guide to securing Laravel applications. Covers configuration hardening, authentication, input validation, XSS and CSRF protection, API security, security headers, dependency management, and production deployment.

Matt King

March 11, 2026

Tools & Reviews 12 min read

Laravel Security Tools Compared: Scanners, Monitors, and Audit Tools

An honest comparison of security tools for Laravel applications. Covers static analysis, dependency scanning, external monitoring, penetration testing, WAFs, and code review tools. Includes a feature comparison table to help you pick the right combination.

Matt King

March 10, 2026

Security 10 min read

Continuous Security Monitoring vs Annual Pentesting: What Your Laravel App Actually Needs

A side-by-side comparison of continuous security monitoring and annual penetration testing. Learn when you need each, what they cost, and how they work together to protect your Laravel application.

Matt King

March 10, 2026

Security 8 min read

Laravel Debug Mode in Production: Why It's Dangerous and How to Fix It

Debug mode in production exposes stack traces, database credentials, environment variables, and internal paths. Learn exactly what it reveals, how attackers use it, and how to make sure it never reaches production.

Matt King

March 9, 2026

Security 16 min read

OWASP Top 10 for Laravel: A Practical Guide

A hands-on mapping of every OWASP Top 10 (2021) category to specific Laravel vulnerabilities, with code examples of what goes wrong and how to fix it.

Matt King

March 9, 2026

Security 8 min read

Is Your Laravel .env File Exposed? How to Check and Fix It

Your .env file contains database credentials, API keys, and encryption secrets. If it's accessible from the web, attackers already have everything they need. Here's how to check and fix it.

Matt King

March 8, 2026

Security 8 min read

Laravel Telescope in Production: Security Risks You Need to Know

Laravel Telescope records every request, query, job, and log entry in your application. Left exposed in production, it gives attackers a real-time view into your entire system.

Matt King

March 8, 2026

Security 10 min read

What Is an Attack Surface? A Developer's Guide

An attack surface is the total number of points where an attacker can try to enter or extract data from your system. Understanding yours is the first step to reducing it.

Matt King

March 7, 2026

Security 10 min read

Composer Audit: Find and Fix PHP Dependency Vulnerabilities

Learn how to run composer audit to detect security vulnerabilities in your PHP dependencies, fix them with composer update, and automate audits in your CI/CD pipeline.

Matt King

March 7, 2026

Security 10 min read

Laravel Security Guide: Every Vulnerability, Fix Guide & Checklist in One Place

The complete index of Laravel security resources. Find fix guides for exposed .env files, debug mode, XSS, CSRF, CORS, session security, and more. Plus checklists, comparison pages, and free scanning tools.

Matt King

March 6, 2026

Security 6 min read

A Guide to Security Headers: What They Do and How to Secure Your Laravel Application

Discover how to secure your Laravel application with the right security headers.

Matt King

March 6, 2026

Laravel Security Checklist 2026: 25 Checks Before You Ship to Production

Laravel File Upload Security: Preventing Remote Code Execution Through Unrestricted Uploads

Subdomain Takeover: How Dangling DNS Records Put Your Laravel App at Risk

CORS Misconfigurations in Laravel: Wildcard Origins, Reflected Headers & How to Fix config/cors.php

The OWASP Top 10 Just Changed. Here Is What It Means for Laravel Teams.

NIST DNS Security Update (SP 800-81r3): 6 Changes That Affect Your Infrastructure

Your Laravel APP_KEY Is Probably on GitHub. Here Is Why That Means RCE.

CVE-2025-54068: Critical Livewire RCE Vulnerability in Laravel (How to Fix)

Fake Laravel Packages on Packagist Are Installing Backdoors. Here Is How to Check.

GitLab 2FA Bypass (CVE-2026-0723): What Happened and How to Protect Yourself

AI Is Writing Your Laravel Code. Who Is Checking Its Security?

The Complete Laravel Security Checklist for 2026

What Is External Attack Surface Management (EASM)?

How to Secure a Laravel Application: The Definitive Guide

Laravel Security Tools Compared: Scanners, Monitors, and Audit Tools

Continuous Security Monitoring vs Annual Pentesting: What Your Laravel App Actually Needs

Laravel Debug Mode in Production: Why It's Dangerous and How to Fix It

OWASP Top 10 for Laravel: A Practical Guide

Is Your Laravel .env File Exposed? How to Check and Fix It

Laravel Telescope in Production: Security Risks You Need to Know

What Is an Attack Surface? A Developer's Guide

Composer Audit: Find and Fix PHP Dependency Vulnerabilities

Laravel Security Guide: Every Vulnerability, Fix Guide & Checklist in One Place

A Guide to Security Headers: What They Do and How to Secure Your Laravel Application

Stay Updated on Laravel Security