<p><strong>TLDR:</strong> Laravel 13.6 landed with debounced queue jobs as the headline feature, alongside a handful of useful additions for API and logging workflows. A critical file upload vulnerability in the Breeze Cache WordPress plugin is being actively exploited in the wild — 400,000+ sites need to update now. The PHP Foundation and JetBrains are planning an official PHP ecosystem survey, with question submissions open until April 28. Spatie released a new Laravel package for generating Apple and Google Wallet passes.</p>
<hr>
<h2>Laravel 13.6: debounced queue jobs</h2>
<p>The <code>#[DebounceFor]</code> attribute is the kind of thing you didn’t know you needed until you’ve debugged a pile of redundant jobs fired by bulk operations. When the same job is dispatched multiple times within a configured window, only the last one runs. A <code>maxWait</code> parameter prevents indefinite deferral. The release also adds JSON responses for the <code>/up</code> health route, a <code>JsonFormatter</code> for structured logging, Cloudflare Email Service integration, and multi-record assertions for <code>assertDatabaseHas</code>.</p>
<h2>Breeze Cache plugin vulnerability (CVE-2026-3844, CVSS 9.8)</h2>
<p>An unauthenticated arbitrary file upload flaw in the Breeze Cache WordPress plugin is being actively exploited. The vulnerable function is <code>fetch_gravatar_from_remote</code>, which skips file-type validation entirely when the “Host Files Locally - Gravatars” feature is enabled. Successful exploitation gives attackers remote code execution and full site takeover. Cloudways patched it in version 2.4.5. If you manage WordPress sites running this plugin, update immediately — don’t wait.</p>
<h2>SQLite on Laravel Forge: a silent data loss trap</h2>
<p>Forge’s zero-downtime deployments clone each release into a new directory and flip a symlink, which means any SQLite database sitting at the default <code>database/database.sqlite</code> path gets wiped on every deploy. The fix is straightforward: move the file into <code>storage/database/database.sqlite</code> and update <code>config/database.php</code> to use <code>storage_path()</code>. Worth flagging to anyone who spun up a quick SQLite-backed project on Forge and hasn’t hit this yet.</p>
<h2>Socket launches reachability analysis for PHP</h2>
<p>Socket is adding experimental CVE reachability analysis for PHP, using function-level call graph analysis to determine whether a vulnerable code path is actually reachable in your specific app. It handles PHP-specific complexity like <code>__call</code> magic dispatch (Laravel Facades, Doctrine proxies) and string-based class instantiation patterns used by Laravel, Symfony, and PHP-DI. Accuracy is reported at over 90% on WordPress, PHPUnit, and Flysystem, and mid-to-high 80s on Twig and Espo. The concrete demo with CVE-2022-29248 in Guzzle — two apps on the same vulnerable version getting different verdicts — is a good illustration of why blanket CVE triage is wasteful.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Spatie Laravel Mobile Pass:</strong> New open-source package for generating Apple Wallet and Google Wallet passes from Laravel, with a unified builder API, Eloquent model integration, live push updates via APNs, and geofencing support.</li>
<li><strong>Laravel Cloud Pre-Check:</strong> Free static analysis tool from Jason McCreary and Laravel Shift that connects to your repo and generates a compatibility report as a pull request, covering PHP version, extensions, Octane config, hardcoded paths, and more.</li>
<li><strong>PHP ecosystem survey:</strong> The PHP Foundation and JetBrains are planning an official community survey launching in June; question submissions are open until April 28.</li>
<li><strong>TYPO3 v14 LTS released:</strong> Major long-term support release with a redesigned backend UI, new default frontend theme (Camino), Form Framework overhaul with CKEditor 5 and database-driven storage, Fluid 5.3, rate limiting via <code>#[RateLimit]</code>, and PHP 8.2–8.5 support.</li>
<li><strong>Laravel 13.5 strict Form Requests:</strong> The <code>#[FailOnUnknownFields]</code> attribute flags any request field not in your validation rules as prohibited — useful for mass assignment protection, though the global mode has a known bug that also flags the CSRF <code>_token</code> field.</li>
<li><strong>Gutenberg 23.0:</strong> 174 merged PRs, including an experimental revisions panel for templates and template parts, real-time collaboration improvements, and a <code>WP_ALLOW_COLLABORATION</code> kill switch.</li>
<li><strong>SymfonyDay Montreal 2026 schedule live:</strong> Eight talks on June 4 covering CQRS, Symfony 8 hexagonal architecture, TUIs with the Terminal Component, legacy migration, and more.</li>
<li><strong>PHPverse 2026:</strong> Free online PHP conference from JetBrains returns June 9, with talks from Jeffrey Way, Fabien Potencier, Nils Adermann, and others.</li>
<li><strong>Laravel API starter kits incoming:</strong> Two draft PRs are open in the Maestro repo — a base stateless API kit and a Teams variant — with no release date set yet.</li>
<li><strong>Composer security advisory:</strong> Upgrade to Composer 2.9.6 or 2.2.27 LTS to fix command injection vulnerabilities in the Perforce VCS driver.</li>
<li><strong>ACF 6.8:</strong> Adds WordPress Core Abilities API integration, experimental <a href="http://schema.org" target="_blank" rel="noopener nofollow">schema.org</a> JSON-LD output, and WP-CLI commands for ACF JSON workflows.</li>
<li><strong>Laravel VS Code extension v1.7:</strong> Adds “Go to Route” navigation to controller actions, Pest syntax autocomplete, Artisan command palette support, and better PHP attribute handling.</li>
<li><strong>wasm2lang:</strong> Open-source tool that transpiles WebAssembly modules to PHP, JavaScript, asm.js, or Java source — useful for deploying portable logic to environments that can’t load WASM, like shared PHP hosting or WordPress plugins.</li>
</ul>


Laravel, WordPress, and PHP ecosystem updates.

PHP Digest

Laravel 13.6 introduces the `#[DebounceFor]` attribute for deduplicating queue jobs within a time window, plus JSON health route responses, structured logging via `JsonFormatter`, and Cloudflare Email integration. A critical unauthenticated file upload vulnerability (CVSS 9.8) in the Breeze Cache WordPress plugin is being actively exploited — 400,000+ sites should update to 2.4.5 immediately. Other highlights include a SQLite data loss trap on Laravel Forge with zero-downtime deployments, Socket's experimental CVE reachability analysis for PHP, Spatie's new Laravel Mobile Pass package, TYPO3 v14 LTS, Gutenberg 23.0, a Composer security advisory, and several Laravel tooling updates.

Laravel 13.6 ships debounced jobs, Breeze Cache plugin actively exploited