Critical · published January 21, 2026
🔥 Talk about a wild ride — Laravel Reverb lets any Redis channel data trigger PHP’s unserialize() function, opening the doors for Remote Code Execution! This is like a restaurant allowing customers to order anything from the menu without checking if they actually have the ingredients — a single order could lead to disastrous results! An attacker could exploit this vulnerability to run malicious code on your server, potentially compromising sensitive data or even taking full control of your application. With Redis commonly running without authentication, this exploit becomes alarmingly easy and could lead to absolute chaos if left unaddressed!
This is like a restaurant allowing customers to order anything from the menu without checking if they actually have the ingredients — a single order could lead to disastrous results! In Laravel Reverb versions 1.6.3 and below, unfiltered data from Redis is fed directly into PHP’s unserialize() function, allowing arbitrary classes to be instantiated and executed, which opens the door for Remote Code Execution.
An attacker could exploit this vulnerability to run malicious code on your server, potentially compromising sensitive data or even taking full control of your application. With Redis commonly running without authentication, this exploit becomes alarmingly easy and could lead to absolute chaos if left unaddressed! Upgrade Laravel Reverb to version 1.7.0 immediately to fix this critical vulnerability. Alternatively, secure your Redis server with a strong password and limit access to a private network. If you’re using only one Reverb node, you can also disable horizontal scaling by setting REVERB_SCALING_ENABLED=false. You can tackle this! With these steps, your application will be back on solid ground in no time. 🛡️