Over 600 Laravel Apps Exposed to Remote Code Execution Due to Leaked APP_KEYs on GitHub
Researchers studying cybersecurity have found a significant security flaw that makes it possible to use stolen Laravel APP_KEYS as a weapon to remotely execute code on hundreds of applications.
GitGuardian stated that Laravel's APP_KEY, which is necessary for encrypting private information, is frequently disclosed to the public (for example, on GitHub). Attackers can use a deserialization weakness to run arbitrary code on the server if they manage to obtain this key, endangering infrastructure and data.
According to the company, which worked with Synacktiv, it was able to discover more than 600 vulnerable Laravel applications by extracting more than 260,000 APP_KEYs from GitHub between 2018 and May 30, 2025. According to GitGuardian, it found over 10,000 distinct APP_KEYs on GitHub,...