Exploited now, patch today

Know when a dependency turns dangerous.

A daily check of the exact Composer and npm versions your Laravel app runs. It tells you once when one becomes vulnerable, and again, loudly, when attackers start exploiting it. Free sources, no keys, no configuration to start.

composer require ruvelo/laravel-security-alerts Read the docs

Halyard · this morning12 Oct, 07:00

Exploited in the wild

livewire/livewire 3.6.2

Livewire is vulnerable to remote command execution during component property update hydration

Severity: Critical · CVE-2025-54068
In CISA KEV: since 20 Mar 2026
Fix: Update to 3.6.4 or later

Halyard’s report

What the package found in the lockfiles of Halyard, a made-up billing app: 67 Composer and 38 npm packages, checked against real advisories. Exploited flaws come first, then by severity.

13 vulnerabilities 1 exploited in the wild 2 critical 4 high 5 medium 1 low Checked 12 October 2026, 07:00, via public feeds

Severity	Package	Installed	Fixed in	Advisory
Exploited	livewire/livewire	3.6.2	3.6.4	Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-54068 · github.com/advisories/GHSA-29cq-5w36-x7w3 In CISA’s catalogue since 20 Mar 2026; US agencies had until 3 Apr 2026 to patch
Critical	form-data npm dev	4.0.3	4.0.4	form-data uses unsafe random function in form-data for choosing boundary CVE-2025-7783 · github.com/advisories/GHSA-fjxv-7rqg-78g4
Critical	predis/predis	3.2.0	3.3.0	Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections CVE-2026-84372 · github.com/advisories/GHSA-w6f5-v2h6-g786
High	form-data npm dev	4.0.3	4.0.6	form-data: CRLF injection in form-data via unescaped multipart field names and filenames CVE-2026-12143 · github.com/advisories/GHSA-hmw2-7cc7-3qxx
High	guzzlehttp/guzzle	7.15.1	7.15.2	Guzzle: Noncanonical host can bypass host-based checks CVE-2026-69246 · github.com/advisories/GHSA-v5mv-p594-2x33
High	maatwebsite/excel	3.1.67	3.1.70	Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path CVE-2026-84374 · github.com/advisories/GHSA-c7r6-vx3h-w5g2
High	vite npm dev	7.3.2	7.3.5	vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571 · github.com/advisories/GHSA-fx2h-pf6j-xcff
Medium	guzzlehttp/guzzle	7.15.1	7.15.2	Guzzle: Noncanonical cookie domain keeps subdomain scope CVE-2026-69245 · github.com/advisories/GHSA-f7vp-7xgx-4w4r
Medium	laravel/framework	12.61.0	12.61.1	Laravel Framework: Temporary Signed URL Path Confusion github.com/advisories/GHSA-crmm-hgp2-wgrp
Medium	livewire/livewire	3.6.2	after 3.8.2	Livewire DOM-based cross-site scripting during client-side state handling CVE-2026-81887 · github.com/advisories/GHSA-g3hc-697w-wm82
Medium	symfony/http-foundation	7.4.12	7.4.13	IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient CVE-2026-48736 · symfony.com/cve-2026-48736
Medium	vite npm dev	7.3.2	7.3.5	launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53632 · github.com/advisories/GHSA-v6wh-96g9-6wx3
Low	laravel/framework	12.61.0	12.69.0	Laravel: XSS in Debug Page Information CVE-2026-102279 · github.com/advisories/GHSA-jh5r-qr3c-85q8

In your terminal, and in CI

The same report from php artisan security-alerts:check, rendered by the real command when this page was built. Add --fail-on=exploited to fail a pipeline, or --json to feed something else.

halyard — zsh

$ php artisan security-alerts:check

┌───────────┬─────────────────────────┬───────────┬──────────┬───────────────────────────────────────────────────────────────────┐
│           │ Package                 │ Installed │ Fixed in │ Advisory                                                          │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Exploited │ livewire/livewire       │ 3.6.2     │ 3.6.4    │ Livewire is vulnerable to remote command execution during compon… │
│           │                         │           │          │ CVE-2025-54068 · github.com/advisories/GHSA-29cq-5w36-x7w3        │
│           │                         │           │          │ In CISA KEV since 2026-03-20, patch by 2026-04-03                 │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Critical  │ form-data npm dev       │ 4.0.3     │ 4.0.4    │ form-data uses unsafe random function in form-data for choosing…  │
│           │                         │           │          │ CVE-2025-7783 · github.com/advisories/GHSA-fjxv-7rqg-78g4         │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Critical  │ predis/predis           │ 3.2.0     │ 3.3.0    │ Predis: Redis command injection and denial of service via CRLF s… │
│           │                         │           │          │ CVE-2026-84372 · github.com/advisories/GHSA-w6f5-v2h6-g786        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ High      │ form-data npm dev       │ 4.0.3     │ 4.0.6    │ form-data: CRLF injection in form-data via unescaped multipart f… │
│           │                         │           │          │ CVE-2026-12143 · github.com/advisories/GHSA-hmw2-7cc7-3qxx        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ High      │ guzzlehttp/guzzle       │ 7.15.1    │ 7.15.2   │ Guzzle: Noncanonical host can bypass host-based checks            │
│           │                         │           │          │ CVE-2026-69246 · github.com/advisories/GHSA-v5mv-p594-2x33        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ High      │ maatwebsite/excel       │ 3.1.67    │ 3.1.70   │ Laravel Excel writes exports outside the configured filesystem d… │
│           │                         │           │          │ CVE-2026-84374 · github.com/advisories/GHSA-c7r6-vx3h-w5g2        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ High      │ vite npm dev            │ 7.3.2     │ 7.3.5    │ vite: `server.fs.deny` bypass on Windows alternate paths          │
│           │                         │           │          │ CVE-2026-53571 · github.com/advisories/GHSA-fx2h-pf6j-xcff        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Medium    │ guzzlehttp/guzzle       │ 7.15.1    │ 7.15.2   │ Guzzle: Noncanonical cookie domain keeps subdomain scope          │
│           │                         │           │          │ CVE-2026-69245 · github.com/advisories/GHSA-f7vp-7xgx-4w4r        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Medium    │ laravel/framework       │ 12.61.0   │ 12.61.1  │ Laravel Framework: Temporary Signed URL Path Confusion            │
│           │                         │           │          │ github.com/advisories/GHSA-crmm-hgp2-wgrp                         │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Medium    │ livewire/livewire       │ 3.6.2     │ >3.8.2   │ Livewire DOM-based cross-site scripting during client-side state… │
│           │                         │           │          │ CVE-2026-81887 · github.com/advisories/GHSA-g3hc-697w-wm82        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Medium    │ symfony/http-foundation │ 7.4.12    │ 7.4.13   │ IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT6… │
│           │                         │           │          │ CVE-2026-48736 · symfony.com/cve-2026-48736                       │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Medium    │ vite npm dev            │ 7.3.2     │ 7.3.5    │ launch-editor: NTLMv2 hash disclosure via UNC path handling on W… │
│           │                         │           │          │ CVE-2026-53632 · github.com/advisories/GHSA-v6wh-96g9-6wx3        │
├───────────┼─────────────────────────┼───────────┼──────────┼───────────────────────────────────────────────────────────────────┤
│ Low       │ laravel/framework       │ 12.61.0   │ 12.69.0  │ Laravel: XSS in Debug Page Information                            │
│           │                         │           │          │ CVE-2026-102279 · github.com/advisories/GHSA-jh5r-qr3c-85q8       │
└───────────┴─────────────────────────┴───────────┴──────────┴───────────────────────────────────────────────────────────────────┘

  13 vulnerabilities in 8 packages: 1 exploited in the wild, 2 critical, 4 high, 5 medium, 1 low.
  Update livewire/livewire to 3.6.4 or later today.
  Checked 67 Composer and 38 npm packages via public feeds.

Daily, on its own

The check is scheduled for you at 07:00. Your scheduler just has to be running.

Once per finding

Seen findings live in one small table, so a cache:clear never re-sends old alerts.

Exit codes for CI

--fail-on=exploited|critical|high|medium|any exits 1; an incomplete check exits 2.

The alert

One email for everything new, exploited first, through your own mailer and theme. Slack gets the same by webhook, and your own notifiables through any channel.

Sent once per finding, and once more if it starts being exploited.
Says what to update to, when CISA listed it and by when US agencies had to patch.
Quiet otherwise: no daily “all clear”, unless you turn on the weekly digest.

Want to react in code? VulnerabilityFound, VulnerabilityExploited and VulnerabilityResolved are events.

Halyard: exploited vulnerability in livewire/livewire, patch todayTo maya@halyard.test, tom@halyard.test

Where it looks, and what it sends

No account or key. By default the check asks Valtry’s Advisory API, which serves the same Packagist, OSV and CISA data from one signed answer, and uses the public feeds below whenever Valtry can’t answer. Set SECURITY_ALERTS_SOURCE=public to never contact it. Answers are cached, so running the command twice is instant.

Source	For	What leaves your server
Valtry Advisory API (default)	Composer and npm packages, and which advisories are exploited	Package names only, never versions; answers are signed and checked
Packagist (fallback, or `public`)	Composer packages: the advisories `composer audit` reads	Package names, in one POST
OSV.dev (fallback, or `public`)	npm packages from `package-lock.json`, if you have one	Package names and versions, like `npm audit`
CISA KEV (fallback, or `public`)	Which CVEs are being exploited in the wild	Nothing: the catalogue is downloaded whole

Nothing about your app is sent: no URL, no environment, no code. Versions never leave your server on the default path; on the public feeds, npm versions go to OSV as with npm audit. This demo was built from recorded answers of the public feeds.