<p><strong>TLDR:</strong> A supply chain attack on Smart Slider 3 Pro pushed backdoored updates to over 900,000 WordPress and Joomla sites this week. Symfony 8.1 is moving toward smaller, standalone bundles with ServicesBundle and ConsoleBundle landing first. PHP 8.5.5 shipped as a routine bug fix release. Laravel Cloud picked up scheduled autoscaling and path blocking to keep hibernated apps from waking on bot traffic.</p>
<hr>
<h2>Smart Slider 3 Pro supply chain compromise</h2>
<p>Hackers hijacked the update distribution system for Smart Slider 3 Pro (version 3.5.1.35), pushing a malicious update to WordPress and Joomla sites. The compromised plugin installs backdoors, creates hidden admin accounts, steals credentials, and achieves persistence through must-use plugins, theme injection, and a wp-includes file that operates independently of the WordPress database. If you’re running this plugin, treat the site as fully compromised: upgrade to 3.5.1.36 or roll back to a pre-April 5 backup, rotate all credentials, reinstall core files, and enable 2FA. This is the kind of incident that makes you rethink auto-updates.</p>
<h2>Symfony 8.1 starts breaking up FrameworkBundle</h2>
<p>The week’s Symfony development activity introduced ServicesBundle and ConsoleBundle as part of a longer effort to split FrameworkBundle into smaller standalone bundles. Symfony Polyfill 1.34.0 also landed, adding ten new polyfills covering PHP 8.4, 8.5, and 8.6 features — including PDO driver-specific subclasses, bcmath rounding functions, IntlListFormatter, and the upcoming PHP 8.6 clamp() function. The PHP minimum requirement for Symfony itself has been bumped to 8.4.1. SymfonyLive Berlin is coming up April 23–24 with talks on static analysis for security and the Symfony AI Mate component.</p>
<h2>WordPress 7.0 release delayed, AI infrastructure lands anyway</h2>
<p>WordPress 7.0’s release cycle has been extended to fix a performance issue in the Real-Time Collaboration database architecture. Pre-release versions are paused until April 17, with a revised schedule due by April 22. In the meantime, the developer-facing changes are substantial: a new WP AI Client PHP library abstracts over OpenAI, Anthropic, Google, Ollama, and others; a Connectors API handles platform-level AI credential management; and WordPress Playground now ships an MCP server that lets AI coding agents like Claude Code control a local WordPress instance over WebSocket. PHP minimum rises to 7.4, with 8.2+ recommended.</p>
<h2>Ninja Forms file upload vulnerability under active exploitation</h2>
<p>CVE-2026-0740 (CVSS 9.8) in the Ninja Forms File Upload premium plugin is being actively exploited. The flaw — missing file type validation and no filename sanitization — lets unauthenticated attackers upload PHP files and achieve remote code execution. Wordfence blocked over 3,600 attacks in 24 hours. The fix has been available since March 19 in version 3.3.27. If you haven’t patched, do it now.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>PHP 8.5.5 released:</strong> Routine bug fix update for the 8.5 branch; all 8.5 users should upgrade.</li>
<li><strong>Laravel Cloud path blocking:</strong> A new firewall feature filters bot probes (wp-admin, .env, .php files) at the edge before they can wake hibernated apps — useful if you’re on a serverless setup.</li>
<li><strong>Laravel Cloud scheduled autoscaling:</strong> Time-based min/max scaling rules for compute and queue clusters, aimed at teams with predictable traffic windows like peak shopping hours or batch jobs.</li>
<li><strong>Filament migrates to Laravel Cloud:</strong> The package (23 million installs) moved from Forge to Cloud and saw 3x request speed improvement, with the full migration of two apps taking three hours.</li>
<li><strong>Laravel VS Code Extension v1.7.0:</strong> Adds PestPHP intellisense with autocomplete for custom expectations, a ‘Go to Route’ command palette action, and support for Laravel 13 routing and Eloquent attributes.</li>
<li><strong>Laravel starter kits get toast notifications:</strong> All four official kits (React, Vue, Svelte, Livewire) now ship with built-in toasts; Inertia stacks use a new <code>Inertia::flash()</code> call, Livewire uses <code>Flux::toast()</code>.</li>
<li><strong>Paragon IE post-quantum PHP:</strong> Two early-stage projects — ext-pqcrypto (Rust extension) and pqcrypto_compat (pure-PHP polyfill) — targeting ML-KEM, ML-DSA, and X-Wing KEM ahead of the 2029 migration window. Not production-ready yet.</li>
<li><strong>PHP RFC: array_get() and array_has():</strong> Proposal for dot-notation deep array access in PHP 8.6 core, standardizing what Laravel’s Arr::get() already does in userland.</li>
<li><strong>Vif experimental package manager:</strong> A Go-based Composer alternative using the PubGrub resolution algorithm; benchmarks show ~8.4s vs Composer’s ~18s on cached runs. Pre-alpha, missing several subcommands.</li>
<li><strong>elephc PHP-to-native compiler:</strong> Experimental Rust-based compiler targeting ARM64 assembly from a PHP subset, producing standalone macOS binaries with no runtime. Renders DOOM E1M1 as a demo. Educational project.</li>
<li><strong>shipmonk dead-code-detector:</strong> PHPStan extension that finds unused methods, constants, enum cases, and properties including transitive dead chains, with automatic removal support and framework integrations for Laravel, Symfony, and Doctrine.</li>
<li><strong>Laracon US 2026:</strong> July 28–29 at SoWa Power Station in Boston. Speakers include Taylor Otwell, Aaron Francis, and Nuno Maduro. CFP is open.</li>
<li><strong>WordPress security roundup:</strong> Six vulnerabilities found across Royal Elementor Addons (unauthenticated file upload), Appointment Hour Booking (CSS injection), Tutor LMS (SQL injection), Better WP Security and SAML SSO (SSRF), and WooCommerce REST API (open redirect). Root cause across all: blind trust in user input.</li>
</ul>


Laravel, WordPress, and PHP ecosystem updates.

PHP Digest

A supply chain attack on Smart Slider 3 Pro pushed backdoored updates to over 900,000 WordPress and Joomla sites, requiring immediate credential rotation and reinstallation. Symfony 8.1 begins splitting FrameworkBundle into smaller standalone bundles (ServicesBundle, ConsoleBundle), with PHP minimum bumped to 8.4.1. WordPress 7.0 is delayed for performance fixes but ships a new WP AI Client library and an MCP server for AI coding agents. A critical CVE (CVSS 9.8) in Ninja Forms File Upload is under active exploitation via unauthenticated PHP file upload. Also covered: PHP 8.5.5 bug fix release, Laravel Cloud scheduled autoscaling and path blocking, Filament's migration to Laravel Cloud with 3x speed gains, a Go-based Composer alternative, an experimental PHP-to-native Rust compiler, and multiple WordPress plugin vulnerabilities.

Smart Slider supply chain attack hits 900K sites, Symfony 8.1 splits FrameworkBundle