Deployments in Laravel Cloud are now turned on globally. You may experience failing or slow deployments in us-east-2 (Ohio) region while we conclude rolling out the security patch.

Laravel Cloud: We are actively applying PHP security patches across the final two Cloud regions, Ohio and Frankfurt. Edge network mitigations of the vulnerability remain in place even for the unpatched regions, providing protection to all customers at this time. Deployments remain paused during this process and will resume once all regions are patched. No action is required on your part. Laravel Vapor: PHP runtime images have been updated with the security patches and are available now. If you would like to apply the patch immediately, you can trigger a redeploy of your application. Automatic redeployment of PHP 8 applications is in progress - we will update this page once that is complete. Docker runtime customers should continue to monitor as updated images are still becoming available. Laravel Forge: PHP has been updated across Forge servers. We are currently working through a high volume of queued update jobs - if your server has not yet received the update, it will shortly. If you need to apply the update immediately, you can do so by accessing your server directly via SSH and following our guide: laravel.com/forge/docs/knowl… Upstream Launchpad PPAs have not yet received patched PHP release. Envoyer: Envoyer is currently offline for maintenance as part of today’s PHP security release. We are updating the underlying servers to versions that support the patched PHP releases. We will update this page as soon as Envoyer is back online. We apologize for the disruption.

The Canada and Tokyo regions of Laravel Cloud are fully patched. Patching is in progress in Virginia, Ireland, Sydney, and France. Patched Laravel Vapor images are rolling out now.

We have temporarily halted Laravel Cloud deployments while we work on automated deployment of patched PHP instances. PHP 8.2+ Vapor images are being built and automated deployment will begin shortly. Envoyer has been temporarily taken offline to receive patching. We will continue to provide frequent updates as rollout continues.

The Laravel Cloud edge network is powered by Cloudflare. All deployed Laravel Cloud applications, including those in dedicated zones and with custom domains, have these rules applied automatically. We are continuing to rollout patched PHP images to address the underlying vulnerability.

At 14:00 UTC two critical security vulnerabilities will be patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No manual action is required. Laravel Forge customers: you will need to manually update your server’s PHP version via the server’s Forge dashboard. If you are unable to update your server, it should be powered down. Laravel Vapor customers: we will begin automatically re-deploying applications running on PHP 8 as soon as the patch is released. No patch is being released for PHP 7 -- immediately update all applications to PHP 8.