Six Questions to Ask About Your Laravel Application's Security
You don't need to read the code to know whether your Laravel application is looked after. Six questions, and what a good answer to each one sounds like.
Emyrix Blog
Security — Emyrix Blog
Every security post we’ve published, newest first.
PHP2Shell: October's Emergency PHP Release Fixes Two Remote Code Execution Bugs
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated RCE bugs in PHP itself. What's affected and how to update.
APSB26-153: October's Magento Patch Closes a Way Around the StyleSmuggler Fix
Adobe's October 2026 Magento patch fixes CVE-2026-103849, a 10.0 template injection Sansec says gets past September's StyleSmuggler hotfix. You need both.
Your Admin Panel Renders What Strangers Typed: An XSS We Shipped, and the Fence Around It Now
A contact form field became a clickable link in our admin. Escaping didn't cover it, because an href is not text. What we shipped, and how it's fenced now.
Implementing a Content Security Policy on a Laravel Site
A step-by-step CSP rollout for a Laravel application: where to set the header, the policy to start from, collecting violation reports, and how to enforce safely.
A Strict Content Security Policy on a Laravel Site, and the Two Things It Caught
Two days of Report-Only reports on our Laravel site found a third-party request nobody chose and a framework requirement we had to grant. What both cost.
APSB26-138: September's Magento Patch Doesn't Contain the Zero-Day Fix
Adobe shipped two Magento security patches a day apart in September 2026, and the monthly one doesn't include the emergency fix for CVE-2026-75650. You need both, in order.
StyleSmuggler: The Magento Zero-Day That Ran for Three Days Unpatched
Sansec disclosed StyleSmuggler on September 5: unauthenticated remote code execution on fully patched Magento and Adobe Commerce stores, used to plant backdoors before Adobe fixed it on September 7 as CVE-2026-75650.
We Recommend Sansec to Every Magento Merchant. Here's Why.
We don't sell Sansec and get nothing if you buy it. We do run it — daily malware scans, and Shield on stores that kept getting reinfected. Here's what it's for and what it won't fix.
APSB26-92: A Magento Account Takeover That Needs No Login
Adobe's August 2026 patch fixes seven Adobe Commerce and Magento vulnerabilities. The worst lets someone take over a customer account without logging in, and attacks started within a day.
Magento 2.4.6 Support Ends August 11. Here's What That Actually Means for You.
Magento 2.4.6 reaches end of support on August 11, 2026 — but the deadline means very different things for Adobe Commerce and Magento Open Source. What to do with the time left.
Magento 2.4.9 Security Patches: Newest Doesn't Mean Safest
Adobe's July 2026 bulletin listed Magento 2.4.9 among the affected versions. Why the newest release line needs the most patch discipline, not the least.
Magento 2.4.8 Security Patches: The Comfortable Version Is Where Discipline Slips
Magento 2.4.8 is supported to 2028, which makes it easy to defer patching. Adobe's cadence changed in 2026 — here's the patch process that keeps up with it.
Magento 2.4.7 Security Patches: Supported Is Not the Same as Patched
Magento 2.4.7 is still supported until 2027 — but Adobe's July 2026 bulletin lists 2.4.7-p10 and earlier as vulnerable. Why patch level matters more than version number.
Working through one of these?
Talk to us.
Upgrades, performance work, and emergency support for Magento, Adobe Commerce, Shopware, and custom Laravel builds.