> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Update your packages! (Yes, this again!) - URL: https://securinglaravel.com/security-tip-update-your-packages-yes-this-again/ - Published: 2026-02-04T05:00:46.000Z - Updated: 2026-02-04T05:00:45.000Z - Description: [Tip #124] I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again... - Author: Stephen Rees-Carter - Tags: Security Tips, Composer, Packages, Vulnerabilities Let's talk about known vulnerabilities, and why it's so important you keep on top of package updates in the apps that we maintain. *(And yes, I know, I talk about this all the time! And yet...)* In July 2025, a **critical** severity vulnerability was disclosed in [*Livewire*](https://livewire.laravel.com/?ref=securinglaravel.com) *v3* ([CVE-2025-54068](https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3?ref=securinglaravel.com)), and everyone [was encouraged](https://securinglaravel.com/security-notice-livewire-v3-rce/) to upgrade as soon as possible. Which many people did... but not everyone. Fast forward 5 months to December 2025, and the security team who discovered the vulnerability released a proof of concept, called [Livepyre](https://github.com/synacktiv/Livepyre?ref=securinglaravel.com), which made it trivial to identify and exploit this vulnerability in the wild. Which happened... [![This Livewire RCE (>=3; < 3.6.4) is now actively being abused with an exploit available; https://securityonline.info/critical-flaw-in-livewire-exposes-laravel-apps-to-stealthy-rce-poc-releases/ Hearing reports of: - new php files in public folder with backdoors - perl scripts active processes - weird jobs in the queue Check your version and update!](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2026/02/image.png)](https://x.com/barryvdh/status/2005404768936865812?ref=securinglaravel.com) "This Livewire RCE (>=3; < 3.6.4) is now actively being abused with an exploit available;..." \~Barry vd. Heuvel And folks started seeing the numbers `8194460` appearing on their apps... ([reddit](https://www.reddit.com/r/laravel/comments/1pyhkqa/weird%5Ftext%5F8194460%5Fappearing%5Fon%5Fmany%5Flaravel/?ref=securinglaravel.com)) As soon as a vulnerability is known, attackers will start trying to exploit it. Initially, all they will have to go on are the code changes in the fixed version, but at some point a Proof of Concept will be published - either by the researchers who discovered the vulnerability, or by a third party who correctly discovers how to put together an exploit. Setting aside the discussion about posting Proof of Concept scripts for exploiting known vulnerabilities *(we can have that another time)*, **this felt like a really good reminder for why updates are important.** I was reminded of Livepyre today when I saw another vulnerability ([CVE-2026-25129](https://github.com/advisories/GHSA-4486-gxhx-5mg7?ref=securinglaravel.com)) was recently disclosed, this time in the [PsySH](https://github.com/bobthecow/psysh?ref=securinglaravel.com) dev console that Laravel uses for Tinker. This vulnerability provides Local Privilege Escalation via a malicious `.psysh.php`, which is autoloaded. As part of the disclosure, a full Proof of Concept is already provided. Update your packages, folks. Here be dragons. --- ***If you found this security tip useful?* 👍** [*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.* ***Want to learn more?* 🤓** *Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support)*! Your support directly funds my security work in the Laravel community.* 🥰 **Need a second set of eyes on your code?** *Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.* *Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*