New Year, New Vulnerabilities - Keeping Your Stack Current

New year, same unpatched dependencies.

January is the perfect time to take stock of your software stack. Not just what you're building next, but what's already running in production. While you're setting goals and planning roadmaps for the year ahead, spare a thought for the code that's been quietly ticking away without attention.

A reality check for PHP teams

If you're running PHP applications right now, here's something that should be on your radar: Laravel 10 security support ends on 4th February 2025. That's less than five weeks away. Laravel 9 already lost security support back in February 2024. If you're still running either of these versions, you're about to be - or already are - running a framework that nobody is patching.

And it's not just Laravel. The same applies across your entire stack. PHP versions, Node packages, CMS platforms, server operating systems - every layer has a support lifecycle, and every one of them eventually stops receiving security fixes.

Why this matters

Security vulnerabilities don't stop being discovered just because a version reaches end of life. They stop being fixed. The CVEs keep coming, but the patches don't.

We see it more often than you'd think. Applications sitting on outdated frameworks, not because the team doesn't care, but because the upgrade kept getting pushed to "next sprint" until it quietly became a much bigger job than it needed to be.

The longer you leave it, the harder it gets. Dependencies drift apart. Breaking changes stack up. What could have been a straightforward afternoon upgrade becomes a multi-week project.

What to do this January

Check your framework version. If you're on Laravel, run php artisan --version and check where that sits against the support timeline. The same principle applies to whatever framework you're using.

Review your dependencies. Run composer audit for PHP projects or pnpm audit for JavaScript. These tools exist specifically to flag known vulnerabilities in your dependency tree.

Plan the upgrade before you need it urgently. Upgrades done proactively are cheaper, safer, and less stressful than emergency migrations forced by a security incident.

Don't forget your infrastructure. PHP version, database server, web server, SSL certificates - all of these have their own lifecycles too.

The bottom line

Security updates aren't glamorous work. They don't ship new features or impress stakeholders in a demo. But they're the difference between a product that's resilient and one that's a liability.

If you're unsure where your applications stand or you need help planning an upgrade path, get in touch. We help teams move to supported versions of Laravel and modernise their stack without the drama.

Start the year with a clean bill of health. Your future self will thank you.