<p><strong>TLDR:</strong> Two chained WordPress CVEs dubbed wp2shell enable unauthenticated remote code execution on default installs running 6.8 through 7.0.1, with public proof-of-concept exploits already in the wild. WordPress maintainers enabled forced auto-updates, but you should manually verify every site you manage is on 7.0.2, 6.9.5, or 6.8.6. PhpStorm 2026.2 landed with GitHub Copilot integration, a new Laravel tool window, and TypeScript 7 support. Laravel 13.20 shipped a first-party Image facade and a migration timestamp fix that matters if you use AI agents to scaffold code.</p>
<hr>
<h2>WordPress wp2shell: unauthenticated RCE via chained CVEs, patch now</h2>
<p>CVE-2026-63030 (REST API batch-route confusion in 6.9+) and CVE-2026-60137 (SQL injection in WP_Query author__not_in, affecting 6.8+) chain together to give an unauthenticated attacker full remote code execution on a stock WordPress install. Public proof-of-concept exploits are on GitHub and in-the-wild exploitation has been reported. Fixed versions are 7.0.2, 6.9.5, and 6.8.6. Forced auto-updates are enabled, but auto-updates don’t always fire reliably — verify every internet-facing site manually. If you can’t patch immediately, block /wp-json/batch/v1 at your WAF; Cloudflare has deployed block-mode rules across all plans including free. <a href="https://daily.dev/feed-by-ids?id=Y6lk9nTq1&amp;id=a8V4Yfi1G" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PhpStorm 2026.2 released with Copilot integration and Laravel tool window</h2>
<p>PhpStorm 2026.2 adds native GitHub Copilot integration via a JetBrains-Microsoft partnership, support for third-party OpenAI-compatible providers in code completion, and an MCP server setup for terminal AI sessions. Laravel developers get a dedicated tool window with a dashboard, error browsing, and Laravel Cloud management. TypeScript 7 lands with up to 4x faster type-checking, and project indexing is up to 10% faster. The #[FileReference] attribute for persistent file path references and PER Coding Style 3.0 support round out the PHP-specific additions. <a href="https://daily.dev/posts/hFtm1SQSi" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Laravel 13.20: Image facade and migration timestamp collision fix</h2>
<p>The headline addition is a new Image facade backed by Intervention Image v4 — you still pull in intervention/image via Composer, but Laravel wraps it with a fluent immutable API covering resize, crop, format conversion, and storage in one chain. More quietly important: a fix for migration timestamp collisions when multiple migrations are generated within the same second. SQLite silently ignores the ordering problem while MySQL throws foreign key errors, so AI-generated migration scaffolding against SQLite dev databases was a common source of production surprises. The release also adds a #[WithoutMiddleware] controller attribute, a dedicated Redis session prefix to avoid cache key collisions, and #[SensitiveParameter] on secret-carrying parameters to reduce accidental exposure in error logs. <a href="https://daily.dev/posts/hgi55fW6F" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Packagist and Composer supply chain: immutable metadata live, gaps remain</h2>
<p>Packagist’s immutable stable version metadata (launched July 7, 2026) is covered in a detailed review of the PHP ecosystem’s supply chain posture following real attacks on packages including laravel-lang and devdojo/wave. Composer 2.9 added automatic security advisory blocking; 2.10 introduced a Dependency Policy Framework with malware filtering at install time. The cross-manifest attack on wave is worth understanding separately: the attacker hid a malicious postinstall script inside package.json in the PHP vendor directory, so npm install triggered a curl command that downloaded and executed a hidden binary. Remaining gaps include mandatory MFA, Trusted Publishing via OIDC, and Sigstore attestations. <a href="https://daily.dev/feed-by-ids?id=isfJ6hklj&amp;id=zSnTaZno9" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Two Joomla extension zero-days (CVSS 10.0) under active exploitation, patches available:</strong> CVE-2026-48939 (iCagenda, fixed in 4.0.8/3.9.15) and CVE-2026-56291 (Balbooa Forms, fixed in 2.4.1) are unrestricted file upload flaws allowing unauthenticated RCE, both added to CISA’s KEV catalog with federal agencies given a three-day patch deadline — check upload directories for unexpected PHP files as the first sign of compromise. <a href="https://daily.dev/posts/4DAXgFZgy" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHP Foundation hires security contractor as AI-generated reports strain triage capacity:</strong> The PHP Foundation hired Alexandre Daubois (CTO of <a href="http://Les-Tilleuls.coop" target="_blank" rel="noopener nofollow">Les-Tilleuls.coop</a>, Symfony/FrankenPHP contributor) as a part-time security contractor to triage php-src reports, with the volume increase partly attributed to AI tools making it easier to generate security reports. <a href="https://daily.dev/posts/RaNC1skvG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PHP 8.6: array_map with first-class callables gets ~10% speedup, up to 1.7x with JIT:</strong> PHP 8.6 introduces a compiler optimization that rewrites array_map calls using first-class callables into for-each loops at compile time, with a real-world Doctrine ORM example showing a 56% gain in hot paths — closures are not yet covered by the optimization. <a href="https://daily.dev/feed-by-ids?id=q2NSPygyP&amp;id=Q4tuPjHNk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Symfony UX 3.3.0 adds Reprise support and two new Shadcn components:</strong> Symfony UX 3.3.0 adds first-class support for Symfony Reprise (the new Vite/Rsbuild asset integration) in StimulusBundle and ships two new Shadcn Toolkit components: Sonner (toast notifications) and Combobox (searchable autocomplete). <a href="https://daily.dev/feed-by-ids?id=2m9QuuFIM&amp;id=tjavNJguf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SecretSpec 0.15 ships PHP SDK with Laravel and Symfony support, adds Azure Key Vault:</strong> SecretSpec 0.15 adds a Composer-installable PHP SDK supporting PHP-FPM, Laravel, and Symfony via native extension or ext-ffi, alongside new Azure Key Vault and Gopass providers and a secretspec export command for shell, dotenv, JSON, and GitHub Actions output formats. <a href="https://daily.dev/posts/3fhN9qofy" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Laravel, WordPress, and PHP ecosystem updates.

PHP Digest

Two chained WordPress CVEs dubbed wp2shell enable unauthenticated remote code execution on default installs running 6.8 through 7.0.1, with public proof-of-concept exploits already in the wild. WordPress maintainers enabled forced auto-updates, but you should manually verify every site you manage is on 7.0.2, 6.9.5, or 6.8.6. PhpStorm 2026.2 landed with GitHub Copilot integration, a new Laravel tool window, and TypeScript 7 support. Laravel 13.20 shipped a first-party Image facade and a migration timestamp fix that matters if you use AI agents to scaffold code.

WordPress RCE chain goes public, PhpStorm 2026.2 ships