> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Use a Supported Version of Laravel!
- URL: https://securinglaravel.com/security-tip-use-a-supported-version/
- Published: 2024-01-22T02:00:27.000Z
- Updated: 2024-09-09T03:16:25.000Z
- Description: [Tip#69] Are you using the latest version of Laravel? If not, do you have an upgrade planned?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Updates

One of the essential steps to keeping your apps secure is keeping your dependencies updated. We’ve talked about [updating](https://securinglaravel.com/security-tip-keep-dependencies-updated/) or [removing](https://securinglaravel.com/security-tip-replace-simple-dependencies/) dependencies before, although that focused mainly on packages, and the [OWASP Top 10](https://securinglaravel.com/t/owasp-top-10) includes [A06:2021 – Vulnerable and Outdated Components](https://securinglaravel.com/owasp-tip-a062021-vulnerable-and/), but we haven’t specifically talked about Laravel framework updates.

At the time of writing this article, the Laravel Framework release schedule has a major release every year in Q1, which is supported with bug fixes for **18 months**, and security fixes for **2 years**.

At the time of updating this article (September 2024), the current major version is 11, with version 10 receiving security fixes, and version 9 and earlier unsupported.

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2024/09/image-1.png)

Laravel Release Schedule as of September 2024.

You can find the updated release schedule here: [https://laravel.com/docs/releases#support-policy](https://laravel.com/docs/releases?ref=securinglaravel.com#support-policy)

Keeping this schedule in mind, it is critical that you keep your app on a supported version of Laravel. Ideally upgrading to the latest version within the first **12-18 months**, to ensure you receive bug fixes, but if not, then upgrade within **2 years** to receive security fixes.

It's easy to say upgrade, but here’s why you should:

If a major vulnerability is discovered in an unsupported version of Laravel, it will be outside the support window and **will not be patched**. This means any application running these older versions will be vulnerable, and open for attack. Only upgrading to a supported version of Laravel will patch the vulnerability and keep the app safe.

This is exactly what the attacks conducted by the "Androxgh0st" malware (as per [Laravel Security Notice #2](https://securinglaravel.com/laravel-security-androxgh0st-malware/)) were doing. They were targeting a known vulnerability in Laravel 5 on apps that hadn’t been updated in years.

This sort of attack happens constantly within the WordPress world, and the fact that *Cybersecurity and Infrastructure Security Agency (CISA)* [released an advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a?ref=securinglaravel.com) that includes Laravel specifically as the target tells me attackers are starting to notice Laravel apps and look for exploits. So we need to be prepared and check our security.

## Stay One Step Ahead of Security Threats!

Join **Securing Laravel* and arm yourself with the knowledge to protect your applications. Get [weekly security tips](https://securinglaravel.com/tag/tips/) delivered straight to your inbox, plus upgrade for access to [monthly In Depth articles](https://securinglaravel.com/tag/in-depth/) that dive deep into crucial security topics. By signing up, you're not just securing your code – you're supporting ongoing security research in the Laravel and PHP community!

Subscribe 

Email sent! Check your inbox to complete your signup. 

No spam. Unsubscribe anytime.