Laravel apps (in general) are safe from the CVE-2026-115560 CVE, since Laravel does not use PHP's native session serializer.
There's no action needed for Laravel apps, unless you have packages or custom code using PHP's native session handler
Commit
45556cc
No, but they are recommending turning off a specific php.ini directive in the meantime (on my phone now but check PHP.net latest post)
php.netPHPPHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.