With all the hacks and breeches going on, don't forget to turn on all your framework's built-in protections. Our Anchor guards against the most common attacks and works with other frameworks and just PHP too
leafphp.dev/docs/security/…#PHP#Binance
We've gathered 740,000+ installs on Packagist. From a tiny router in 2019 to a whole ecosystem, and the three busiest months we've had. We wrote up the journey, numbers and all
👉🏾 blog.leafphp.dev/posts/740k-ins…
Hi PHP fam, this one is worth two minutes of your Friday. A stock Leaf app sits outside the affected group, but there is no reason to leave the door open.
Add this to your php.ini or .user.ini and restart. It has to be an ini setting, ini_set() at runtime won't take it.
You can
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php#phpc
Updated Leaf releases are out for the PHP2Shell fixes: leaf CLI v5.0.10, MVC v5.2.2 and Aloe v4.5.6. Every Docker scaffold we ship now runs on patched PHP (8.4.27 / 8.3.36).
Leaf itself didn't need a code change, just update your PHP 👌🏽
