Laravel Security Updates, October 2026: TokenGuard Auth Bypass, Livewire Fixes, and PHP2Shell

October has been a busy month for anyone running Laravel. On 19 October the Laravel team published two advisories for the framework, one of them critical: CVE-2026-114509, which lets an unauthenticated attacker log in as an existing user on routes protected by the built-in token guard. Three days later Livewire disclosed an authorization bypass in its #[Authorize] attribute. And underneath both, every Laravel application runs on PHP, which received emergency fixes for the two PHP2Shell vulnerabilities on 21 October. The good news is that the framework fixes have been available since 25 August. If you update dependencies regularly, you may already be safe. If your composer.lock has not moved since summer, read on.

The Short Version

In practice, updating to the latest release of your Laravel major version (13.39.0 and 12.70.2 at the time of writing) and the latest Livewire covers every framework item in the table. PHP has to be updated separately on the server.

CVE-2026-114509: Logging In Without a Token

TokenGuard is the simple API guard that has shipped with Laravel for years: the token driver in config/auth.php, which looks up a user by comparing the token in the request against a column in the users table, api_token by default. It predates Sanctum and Passport and many teams have forgotten it is there, but plenty of older APIs, internal integrations, and mobile backends still rely on it.

According to the advisory, TokenGuard did not reject a credential that was not a string. On MySQL and MariaDB, a specially crafted non-string value could make the lookup query match an existing user who never shared their token. The result is account takeover on every route behind that guard, without authentication and without any user interaction. Laravel has not published the exact payload, but MySQL is well known for loosely converting types when it compares values of different kinds, and that is the class of behaviour the fix closes. The CVE record is rated 9.2 under CVSS 4.0, and Rapid7 lists a public proof-of-concept.

You are affected if all three of these are true: your application uses a guard with the token driver, the users table lives on MySQL or MariaDB, and laravel/framework is older than 12.68.0 on the 12.x line or older than 13.29.0 on 13.x. For Laravel 11, vulnerability databases such as Mend list 11.56.1 as the fixed release, which shipped on the same day as the 12.x and 13.x fixes. Laravel 10 and older no longer receive security fixes at all.

The advisory does not mention Sanctum or Passport, which use their own guards. Do not take that as a reason to skip the update: the fix is a framework release, and the other three framework issues in the table apply regardless of which guard you use.

The Other Framework Fixes

• CVE-2026-114508, published alongside the TokenGuard issue, affects Laravel 12.45.0 and later. Under certain conditions, a request to a read-only endpoint that includes related models could trigger a destructive operation on the related table. A user with read access could empty a table they should only be able to view. The advisory gives no workaround; upgrading is the fix.
• CVE-2026-48019, from June, is a CRLF injection in the default email validation rule. Combined with how Symfony Mailer handles certain characters, an attacker can tamper with outgoing mail when the application sends email to an address typed by a user: registration, password reset, contact forms. It is rated high at 8.9.
• CVE-2026-48041 affects temporary signed URLs from the local filesystem driver. Expired links could keep working, or resolve to a different file than the one signed. The risk is low, but it is fixed in the same upgrade.

Livewire and Filament

Livewire 4.4.8, released on 21 October, fixes three ways around the #[Authorize] attribute introduced in 4.3.0. By reordering parameter keys in a request, a logged-in user could pass the authorization check on a record they own while the action ran against someone else's record. The advisory's example is deleting another user's comment. The same applied to event listeners using #[On], and methods marked #[Json] ran their body before authorization, so database writes happened even though the client received a 403. Applications that call $this->authorize() inside the method, and all of Livewire 3, are not affected.

Separately, CVE-2026-81887 is a DOM-based XSS fixed in Livewire 3.8.3 and 4.3.4 at the end of July. And if you still have Livewire 3 older than 3.6.4 somewhere, that version carries CVE-2025-54068, an unauthenticated remote code execution that CISA lists as actively exploited. Filament panels are built on Livewire, so an admin panel you installed two years ago and never touched is exactly where an old version tends to hide.

PHP2Shell: The Layer Under Laravel

None of the framework fixes matter much if PHP itself is exploitable. CVE-2026-109618 and CVE-2026-109619 are rated 9.2 and affect every PHP version going back to 2004. We cover them in detail in our PHP2Shell article; for Laravel teams, the platform you deploy on decides what you have to do:

• Laravel Forge: automatic security updates do not patch PHP, because Forge installs PHP from a separate package repository. Use Update PHP in the server's PHP tab for every installed version, including ones no site currently uses.
• Laravel Cloud: patched automatically.
• Laravel Vapor: applications on PHP 8 were redeployed automatically. PHP 7 runtimes received no patch and must move to PHP 8. Docker runtime images need to be rebuilt.
• Your own VPS or cPanel hosting: update the PHP packages from your distribution or the ondrej/php repository, or ask your host to confirm the version.

An Update Routine That Does Not Miss Anything

1. 1See what you are running: composer show laravel/framework livewire/livewire on the production lock file, and php -v plus php-fpm8.x -v on the server.
2. 2Run composer audit. It checks composer.lock against the Packagist advisory database and lists every package with a known vulnerability, including the ones above.
3. 3Update within your major version: composer update laravel/framework livewire/livewire --with-all-dependencies. This keeps you on the same Laravel and Livewire major and only pulls in patch and minor releases.
4. 4Run your test suite and check the parts touched by these fixes: API routes behind token guards, any endpoint that loads relationships from request parameters, email sending, and Livewire components that use #[Authorize].
5. 5Deploy, then rebuild the caches with php artisan optimize so the new framework code is used everywhere.
6. 6Restart long-running processes. php artisan queue:restart, php artisan horizon:terminate, and php artisan octane:reload, or restart them through Supervisor. A queue worker started last week is still running last week's code.

If you still use TokenGuard, this is also a good moment to plan a move to Sanctum. It stores hashed tokens, supports expiry and abilities, and is the option the Laravel documentation has recommended for API tokens for several years.

The pattern this month is worth noting. The TokenGuard fix shipped quietly on 25 August, and the advisory only appeared almost two months later. Teams that update dependencies every few weeks were protected before anyone knew there was a problem. Teams that only update when something breaks were exposed the whole time. A monthly composer update and composer audit, done as routine maintenance, is cheaper than any incident response.