Cybersecurity researchers from GitGuardian and Synacktiv uncovered a major security issue affecting Laravel applications. It seems that over 600 Laravel apps were found to be vulnerable to remote code execution (RCE) attacks after their secret APP_KEY were leaked publicly, primarily on GitHub.
Why Is APP_KEY Important?
APP_KEY is a 32-byte encryption key generated during Laravel installation. It is used for encrypting sensitive data, signing tokens, and securing session cookies. The key is typically stored in the .env configuration file, which often contains other secrets as well.
How Did the Exposure Happen?
Researchers were able to extract over 260,000 APP_KEYs from GitHub repositories between 2018 and May 2025. At least 10,000 unique APP_KEYs were found, with 400+ validated as functional. More than 600 live applications were confirmed vulnerable, and about 120 remain at immediate risk of trivial RCE attacks.
The Exploit Mechanism
Laravel’s decrypt() function automatically deserializes decrypted data. If an attacker obtains the APP_KEY, they can decrypt sensitive data and session cookies, craft malicious serialized PHP objects, and trigger deserialization attacks, leading to arbitrary code execution on the server. Tools like phpggc and custom Laravel exploit scripts make this process straightforward for attackers.
Broader Impact
35% of exposures involved other secrets, such as database credentials, cloud storage tokens, and payment keys, compounding the risk. Many leaks also included the APP_URL, enabling attackers to directly target the affected application. Researchers also found that some developers failed to rotate compromised keys, only deleting them from repositories, leaving production systems exposed.
Example Vulnerability
- CVE-2024-55555 (Invoice Ninja): Demonstrates RCE via APP_KEY compromise in real-world Laravel apps. The vulnerability affects Laravel versions from 5.1 through 11.34.2+.
Security Recommendations
- Never commit
.envfiles or secrets to public repositories. - Rotate any exposed APP_KEY immediately; simply deleting it from source control is not enough.
- Use automated tools to monitor for secret exposures.
- Regularly audit all credentials in configuration files and rotate them as part of incident response.
