Laravel 13.40 Security Fix: Is Your Laravel App Up to Date?

Laravel 13.40.0, released on 3 November 2026, fixes a remote code execution bug in Concurrency::run(). It is the third Laravel security fix in about a month, and it comes two weeks after the critical PHP2Shell release. If your website or app runs on Laravel, this is a good week to check that it is up to date.

Facts checked on 5 November 2026. Details can change as maintainers publish more information, so confirm against the sources at the end.

What was fixed

Laravel's Concurrency facade runs tasks in parallel. With the default process driver, each task runs in a separate PHP process and sends its result back to your app as text. The problem was that anything the task printed went through the same channel as the result.

So if a task printed text that a user controlled, an attacker could make that text look like a result. Your app would then unserialize it, and unserializing attacker-controlled data can lead to remote code execution: someone else running code on your server.

The fix in 13.40.0 signs every result with a key that the app creates for that task, and ignores anything that is not signed. It also stops ordinary task output from crashing the request, which was a bug on its own.

We are not describing how to exploit this. For site owners and teams, the useful questions are: do we use it, and are we on the fixed version?

Are you affected?

You are most exposed if all of these are true:

• your app calls Concurrency::run() or Concurrency::defer(),
• with the process driver (the default), and
• a task can print output that includes user input, for example by echoing a value or calling code that does.

Apps that never use Concurrency are not exposed by this bug, but update anyway: 13.40.0 also includes the earlier fixes below.

On Laravel 12? The Concurrency facade exists in Laravel 12 too. The fix was merged into the 13.x branch, and on 5 November we could not find a 12.x release that includes it (the latest was 12.70.2, from 27 October). If you are on 12 and use Concurrency with the process driver, watch for a 12.x release, and in the meantime make sure tasks never print user input, or use the sync driver for those tasks.

Three Laravel fixes in a month

The TokenGuard bug let someone sign in as an existing user without knowing their API token. Sanctum and Passport use their own drivers and are not listed as affected. PHP2Shell is a flaw in the PHP engine, so it affects Laravel and every other PHP app. We covered it in PHP2Shell: Critical PHP Flaws Put Unpatched Websites at Risk.

Is your version still supported?

Updating only helps if your version still gets fixes:

• Laravel 11 and older stopped receiving security fixes on 12 March 2026. They did not get the TokenGuard fix, and they will not get the next one.
• Laravel 12 gets security fixes only, until 24 February 2027. Plan the move to 13 now, not in February.
• Laravel 13 gets security fixes until 17 March 2028.
• PHP 8.2 stops receiving security fixes on 31 December 2026. Laravel 13 needs PHP 8.3 or newer anyway.

If you are on Laravel 11 with PHP 8.2, both parts of your stack are out of support by the end of the year. That is the upgrade to schedule first.

What to do this week

1. Check your Laravel version

Run php artisan about or composer show laravel/framework on the server, or look up laravel/framework in composer.lock. Check the version that is deployed, not only the one on your laptop.

2. Update the framework

Run composer update laravel/framework, run your tests, and deploy. Within the same major version this is a minor update, and minor releases should not contain breaking changes. On Laravel 13 you want 13.40.0 or newer.

3. Check PHP as well

Run php -v, and check the version your web server uses too (your hosting panel or a temporary phpinfo() page you delete afterwards). You want PHP 8.4.27, 8.5.12, 8.3.36 or newer on those branches.

4. Run composer audit

It checks every installed package against published security advisories, not only Laravel. Add it to your CI so a vulnerable package fails the build instead of reaching production.

5. Make updates routine

Most of these fixes were small updates that took minutes to apply. The risk comes from apps that nobody updates for months. A short monthly slot for framework and PHP updates, plus alerts for security advisories, keeps that risk low.

How Develenza can help

We build and maintain Laravel applications, including our own website. If you are not sure which versions your apps run, or you need help moving from Laravel 11 or 12 to 13, contact us. We can check your apps, apply the updates and set up a routine so the next fix does not catch you out.

Sources

• Laravel News: Laravel 13.40.0 release
• laravel/framework pull request #62297: the Concurrency fix
• laravel/framework releases on GitHub
• Laravel News: TokenGuard auth bypass fixed in 13.29 and 12.68
• Laravel release notes and support policy
• PHP supported versions
• Server Side Up: what to patch this week (October 2026)