---
title: "Over 600 Laravel Apps Exposed to Remote Code Execution Due to Leaked APP_KEYs on GitHub"
url: https://daily.dev/posts/over-600-laravel-apps-exposed-to-remote-code-execution-due-to-leaked-app-keys-on-github-hknko9yfu
source_url: https://thehackernews.com/2025/07/over-600-laravel-apps-exposed-to-remote.html
type: article
source: "The Hacker News"
published: 2025-07-12T13:42:41.508Z
updated: 2025-07-12T13:43:03.452Z
tags: ["security", "github", "php", "laravel", "vulnerability"]
reading_time: 5
upvotes: 41
comments: 1
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Over 600 Laravel Apps Exposed to Remote Code Execution Due to Leaked APP_KEYs on GitHub

**[The Hacker News](https://daily.dev/sources/thn)** · 5 min read · 41 upvotes · 1 comments

## Summary

Security researchers discovered over 260,000 leaked Laravel APP_KEYs on GitHub, with 600+ applications vulnerable to remote code execution attacks. The vulnerability stems from Laravel's decrypt() function automatically deserializing data, allowing attackers with exposed APP_KEYs to execute arbitrary code. The issue affects both older Laravel versions (CVE-2018-15133) and newer versions with specific session configurations (CVE-2024-55556). Researchers found 63% of exposures come from .env files containing additional sensitive data, and 28,000 APP_KEY/APP_URL pairs were exposed together, making attacks trivial. Proper mitigation requires immediate key rotation, system updates, and continuous secret monitoring rather than simply deleting exposed keys.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://thehackernews.com/2025/07/over-600-laravel-apps-exposed-to-remote.html>

## Community discussion

Top comments from developers on daily.dev.

**@ravavyr** · 1 upvotes

> I wish we had a simpler PHP framework to use.
> Laravel's dependency on composer, plus the heavy tie in with Vue just makes it an uglier version of the JS Frameworks mentality.
>
> You don't need composer or any compiler to write good PHP.
> A framework that doesn't rely on any of that would also be easier to manage/modify/maintain/debug.
>
> Alas, Laravel has its big following in the PHP community and has no real competition, so it draws in all the newbies too... and newbies will 100% make mistakes like the one in this post. Senior devs will do it too from time to time... because to be human is to...

## Similar posts on daily.dev

- [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments
- [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments
- [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments
- [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments
- [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#php](https://daily.dev/tags/php), [#laravel](https://daily.dev/tags/laravel), [#vulnerability](https://daily.dev/tags/vulnerability)

[View this post on daily.dev](https://daily.dev/posts/over-600-laravel-apps-exposed-to-remote-code-execution-due-to-leaked-app-keys-on-github-hknko9yfu)