Symfony Blog

Symfony Blog 1d Javier Eguiluz

A Week of Symfony #1014 (June 1–7, 2026)

Symfony Blog 2d Javier Eguiluz

New in Symfony 8.1: Console Progress and Testing Improvements

Symfony Blog 3d Javier Eguiluz

New in Symfony 8.1: ObjectMapper Improvements

Symfony Blog 4d Eloïse Charrier

SymfonyOnline June 2026: Symfony 8: The Hexagonal Track

Symfony Blog 4d Javier Eguiluz

New in Symfony 8.1: HttpClient Improvements

Symfony Blog 4d Eloïse Charrier

SymfonyOnline June 2026: Building TUIs in PHP: The Symfony Terminal Component

Symfony Blog 4d Eloïse Charrier

SymfonyOnline June 2026: From Web to Mobile with Symfony & Hotwire Native

Symfony Blog 5d Eloïse Charrier

SymfonyOnline June 2026: Discover the Workshops!

Symfony Blog 5d Javier Eguiluz

New in Symfony 8.1: RateLimiter Improvements

Symfony Blog 5d Eloïse Charrier

SymfonyOnline June 2026: Protect your data with Queryable Encryption

Symfony Blog 7d Javier Eguiluz

A Week of Symfony #1013 (May 25–31, 2026)

Symfony Blog 8d Fabien Potencier

Twig 3.27.1 released

Symfony Blog 8d Eloïse Charrier

SymfonyOnline June 2026: Building MCP Servers with the Official PHP SDK

Symfony Blog 9d Eloïse Charrier

SymfonyOnline June 2026: Hunting Vulnerabilities in Symfony with LLMs

Symfony Blog 9d Fabien Potencier

Symfony 8.1 curated new features

Symfony Blog 9d Fabien Potencier

Symfony 8.1.0 released

Symfony Blog 9d Fabien Potencier

CVE-2026-49211: Information exposure via unescaped LIKE wildcards in EntitySearchUtil

Symfony Blog 9d Fabien Potencier

CVE-2026-49208: Format-less date LiveProps parsed with the permissive DateTime constructor

Symfony Blog 9d Fabien Potencier

CVE-2026-49209: Denial of service in symfony/ux-live-component via unbounded batch action requests

Symfony Blog 9d Fabien Potencier

CVE-2026-49215: CSRF Protection Bypass in symfony/ux-live-component: Accept Header is CORS-Safelisted

Symfony Blog 9d Fabien Potencier

CVE-2026-49216: XSS in symfony/ux-autocomplete via unescaped AJAX response data

Symfony Blog 9d Fabien Potencier

CVE-2026-49210: XSS in symfony/ux-live-component via attacker-controlled child component tag

Symfony Blog 9d Fabien Potencier

CVE-2026-49212: LiveComponentHydrator HMAC checksum lacks component and slot binding

Symfony Blog 9d Fabien Potencier

Symfony UX 3.1.0 released

Symfony Blog 9d Fabien Potencier

Symfony UX 2.36.0 released

Symfony Blog 10d Eloïse Charrier

SymfonyOnline June 2026: Giving voice to your agents, the Symfony AI way

Symfony Blog 10d Javier Eguiluz

New in Symfony 8.1: Dependency Injection Improvements

Symfony Blog 11d Eloïse Charrier

SymfonyOnline June 2026: Custom PHPStan Rules: Guardrails for AI-Assisted Symfony Code

Symfony Blog 11d Javier Eguiluz

New in Symfony 8.1: Improved JSON Streaming and Querying

Symfony Blog 11d Fabien Potencier

CVE-2026-48808: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Symfony Blog 11d Fabien Potencier

CVE-2026-48805: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Symfony Blog 11d Fabien Potencier

CVE-2026-48806: Sandbox `__toString()` policy bypass via dynamic mapping keys

Symfony Blog 11d Fabien Potencier

CVE-2026-46636: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders

Symfony Blog 11d Fabien Potencier

CVE-2026-48807: Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators