--- title: NativePHP Mobile Security Advisories: Update to 4.6.1 description: NativePHP has published its first security advisories, seven at once, for NativePHP for Mobile. All seven are fixed in nativephp/mobile 4.6.1 and 3.3.11, and... canonical: https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: NativePHP Mobile Security Advisories: Update to 4.6.1 | daily.dev og:description: NativePHP has published its first security advisories, seven at once, for NativePHP for Mobile. All seven are fixed in nativephp/mobile 4.6.1 and 3.3.11, and... og:url: https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp og:image: https://api.daily.dev/og/posts/uVMN9LKjP.png og:image:alt: NativePHP Mobile Security Advisories: Update to 4.6.1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # NativePHP Mobile Security Advisories: Update to 4.6.1 **[Laravel News](https://daily.dev/sources/ln)** · 4 min read · 1 upvotes · 0 comments ## Summary NativePHP has published its first security advisories, seven at once, for NativePHP for Mobile. All seven are fixed in nativephp/mobile 4.6.1 and 3.3.11, and in the mobile-file plugin 1.0.3. Five are rated High severity with CVSS scores from 7.4 to 8.1. Most issues come from internal /_native/api/* routes and mostly require an attacker to already have JavaScript running in your app's web view. Versions 1.x and 2.x are end-of-life and won't be patched. Separately, NativePHP rebuilt its bundled PHP binaries after PHP 8.5.12, 8.4.27 and 8.3.36 fixed two CVEs rated 9.2 under CVSS v4.0. Developers must update, run 'php artisan native:install --force', rebuild and resubmit to app stores. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What should I do after NativePHP for Mobile's security advisories were published? Update nativephp/mobile to 4.6.1 (or 3.3.11 on the 3.x line), uninstall or update the mobile-file plugin to 1.0.3, run 'php artisan native:install --force' to regenerate the native project, then rebuild and submit the new build to the App Store and Google Play. A package update alone doesn't protect users until they install the new app version. _Teams shipping NativePHP mobile apps track rollout steps like these on daily.dev._ ### What CVSS severity do the NativePHP mobile security advisories have? Five of the seven advisories are rated High, with CVSS scores ranging from 7.4 to 8.1. Most stem from internal /_native/api/* routes lacking middleware, and most attacks require an attacker to already have JavaScript running in the app's web view, such as through an XSS bug or compromised third-party script, which is why attack complexity is listed as high on most scores. _Developers triaging mobile package CVEs keep up with advisories like these via daily.dev._ ### Which PHP CVEs were fixed in PHP 8.5.12, 8.4.27, and 8.3.36? The October 21 PHP releases fixed CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. NativePHP rebuilt every PHP binary it distributes on these patched releases, removed vulnerable builds, and now ships binaries with published hashes and signatures that tooling checks on download. _Anyone bundling PHP in a mobile or desktop app can track critical CVEs like these on daily.dev._ ## Similar posts on daily.dev - [A 14-Year-Old PHP Bug Lets Strangers Run Code on Your Server. Here's How to Stop It](https://daily.dev/posts/a-14-year-old-php-bug-lets-strangers-run-code-on-your-server-here-s-how-to-stop-it-vd0nya50m) · Medium · 2 upvotes · 0 comments - [PHP2Shell Shows Why Security Cannot Stop at the Last Test](https://daily.dev/posts/php2shell-shows-why-security-cannot-stop-at-the-last-test-kibbq2lgf) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mobile](https://daily.dev/tags/mobile), [#php](https://daily.dev/tags/php), [#laravel](https://daily.dev/tags/laravel) [View this post on daily.dev](https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"NativePHP Mobile Security Advisories: Update to 4.6.1","url":"https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp"},"datePublished":"2026-10-26T13:49:04.080Z","dateModified":"2026-10-26T13:49:33.049Z","description":"NativePHP has published its first security advisories, seven at once, for NativePHP for Mobile. All seven are fixed in nativephp/mobile 4.6.1 and 3.3.11, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cdcf4e4712a81fc3f763fa710d5eb35e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cdcf4e4712a81fc3f763fa710d5eb35e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Laravel News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Laravel News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ln","url":"https://daily.dev/sources/ln"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mobile,php,laravel","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Laravel News","item":"https://daily.dev/sources/ln"},{"@type":"ListItem","position":3,"name":"NativePHP Mobile Security Advisories: Update to 4.6.1"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/nativephp-mobile-security-advisories-update-to-4-6-1-uvmn9lkjp#faq","mainEntity":[{"@type":"Question","name":"What should I do after NativePHP for Mobile's security advisories were published?","acceptedAnswer":{"@type":"Answer","text":"Update nativephp/mobile to 4.6.1 (or 3.3.11 on the 3.x line), uninstall or update the mobile-file plugin to 1.0.3, run 'php artisan native:install --force' to regenerate the native project, then rebuild and submit the new build to the App Store and Google Play. A package update alone doesn't protect users until they install the new app version. Teams shipping NativePHP mobile apps track rollout steps like these on daily.dev."}},{"@type":"Question","name":"What CVSS severity do the NativePHP mobile security advisories have?","acceptedAnswer":{"@type":"Answer","text":"Five of the seven advisories are rated High, with CVSS scores ranging from 7.4 to 8.1. Most stem from internal /_native/api/* routes lacking middleware, and most attacks require an attacker to already have JavaScript running in the app's web view, such as through an XSS bug or compromised third-party script, which is why attack complexity is listed as high on most scores. Developers triaging mobile package CVEs keep up with advisories like these via daily.dev."}},{"@type":"Question","name":"Which PHP CVEs were fixed in PHP 8.5.12, 8.4.27, and 8.3.36?","acceptedAnswer":{"@type":"Answer","text":"The October 21 PHP releases fixed CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. NativePHP rebuilt every PHP binary it distributes on these patched releases, removed vulnerable builds, and now ships binaries with published hashes and signatures that tooling checks on download. Anyone bundling PHP in a mobile or desktop app can track critical CVEs like these on daily.dev."}}]} ```