PHP emergency security releases — Oct 2026
PHP CVEs 2026-109618 and 2026-109619 (CVSS 9.2 RCE). Update to 8.4.27 or 8.5.12; what Externa users must do.
Blog
Externa runs on Laravel — install, Public API, and headless frontends on your stack.
Dieser Artikel ist nur auf Englisch verfügbar.
PHP CVEs 2026-109618 and 2026-109619 (CVSS 9.2 RCE). Update to 8.4.27 or 8.5.12; what Externa users must do.
Patch for draft/revision field renames, npm audit clean-up, and the repair-renamed-field-drafts artisan command.
Turn the official Externa Next.js starter into a blog: Articles pack, public role Read, and Public CMS API list/post pages.
EN/IT landing page with the Externa Nuxt starter: content languages, Translation workspace, and locale-aware Nitro API calls.
Open Externa drafts in your Next.js app: Live Preview URL, GET /api/v1/preview, same components as production.
Approvals, translation workspace, kanban/calendar, SSO, Meilisearch, git export, Slack/Telegram, and the Nuxt starter — all opt-in.
Post-GA cut: Live Preview tokens, draft/publish UX, scheduled publish, OpenAPI, webhooks UI, Next starter, and AI tool approval.
What GA means for operators: Packagist install, Docker quick-deploy, webhook secret enforcement, and how to upgrade from beta.4.