Shahrukh A. Khan @Shaz3e

What if Laravel built PHP?

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild. watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet. If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it. How the attack works, in plain English: 🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it. 🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead. 🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully." 🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory. 🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root. From start to finish, the attack takes a handful of HTTP requests. If you run cPanel or WHM, the patched versions are: 🔴 cPanel/WHM 110.0.x → 11.110.0.97 🔴 cPanel/WHM 118.0.x → 11.118.0.63 🔴 cPanel/WHM 126.0.x → 11.126.0.54 🔴 cPanel/WHM 132.0.x → 11.132.0.29 🔴 cPanel/WHM 134.0.x → 11.134.0.20 🔴 cPanel/WHM 136.0.x → 11.136.0.5 If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

keyboard_arrow_left Previous keyboard_arrow_right Next

@tweetskynet is down more than 8hrs no support tech online no reply on ticket

Okay, badge.laravel.cloud is now a thing. Really happy with the @Laravel cloud domain 😄 Still a few things I want to do, but I thought it would be better to get it out there instead of letting it gather dust.

@PovilasKorop lol Laravel errors are most common

@laravelbackpack That’s a lot of help already using this in my application

@laravelbackpack In my preference service class is most powerful and scalable solution for automate test observer didn’t work well with test

🚨 Security Alert: axios versions 1.14.1 and 0.30.4 were compromised on npm with a remote access trojan hidden in a postinstall script. Both versions have since been removed. This was not a Laravel vulnerability — but we're taking proactive steps to protect our community from this supply chain attack. If you installed or updated axios in the last 24 hours, scan your machine. What we did: • Pinned axios to safe versions in laravel/laravel • laravel/installer now runs package installs with --ignore-scripts by default • Blocked the attacker's domain across Laravel Cloud More info: github.com/axios/axios/is…

If you can code it, you can build it.

Don’t let perfection stand in the way of progress start your project and let it be perfect by time.

Welcome to the first Friday of Ramadan. A day to reset our intentions and nourish our souls. May Allah (SWT) accept our fasts, our prayers, and our good deeds during this beautiful month. Jummah Mubarak from the team at DiligentCreators. #FridayBlessings #IslamicReminders

Wishing You a Month of Faith, Reflection & New Beginnings 📷📷 From all of us at Diligent Creator Ramadan Kareem Mubarak! 📷 #DiligentCreators #ConstructingIdeas #RamadanKareem #NewBeginnings #FaithAndReflection #Ramadan2026 #DreamBig #RamadanMubarak

Success is built on discipline, and there is no greater teacher of discipline than the holy month of Ramadan. Whether we are deep in study, focused on our projects, or sharing a meal with loved ones, every moment is an opportunity for growth. Ramadan Mubarak from all of muslims.

We're not actually sorry.

Taylor Otwell @taylorotwell

5 months ago

Sorry for so much shipping today 😅 but, we also just launched a new starter kit. Laravel + Svelte + Inertia. ❤️ Just update your Laravel installer for access.

53 60 775 68K 51

Nightwatch now has @linear integration. Enable issue creation with click of a button. linear.app/integrations/l…

Jumma Mubarak! Wishing you a day filled with grace and countless blessings. 🕌🙏 #Jumma #FridayVibes #BlessedFriday #IslamicArt #Spirituality

@GithubProjects That’s very direct

Laravel protip. Control which scheduler commands run in different environments with the `when()` method. Gate critical tasks to production, dev tasks to local seamlessly.

After Laravel 12.51 👀 If you want to run code after a Laravel notification is sent, you can use `afterSending()` ⚡ Perfect for logging, analytics, or follow-up actions.

@PovilasKorop I have build one project this using the same method just avoiding AppServiceProvider being massy with 40+ models