{"id":"laravel-livewire-code-injection-attacks-mar-2026","category":"patch","status":"closed","title":"Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft","tldr":"Attackers are exploiting Laravel Livewire CVE-2025-54068 to steal website credentials and databases. Website operators should update to 3.6.4 or later and investigate possible compromise. Visitors have no device update to install.","summary":"CVE-2025-54068 affects Livewire, software used to build Laravel websites. Certain configurations let remote attackers run commands without authentication or user interaction. Earlier major versions are unaffected. Livewire’s description includes 3.6.3, although its affected-version field excludes that release; 3.6.4 is the confirmed fix, with no known workaround. CISA listed the flaw as exploited on 20 March 2026. Imperva subsequently investigated a credential-theft campaign and reported credentials from 6,167 applications, including payment, cloud, email and database secrets. Recovered database dumps showed that stolen credentials had also been used to extract data. Victims spanned businesses, healthcare, education and government. As at 3 November 2026, the software fix remains available, but these sources do not establish that the campaign has ended or that every affected operator has been notified. Updating does not resolve credentials or data already stolen.","action":"If you run a website, ask its developer or hosting provider to update Livewire to 3.6.4 or later and check for compromise. If compromise is suspected, have them rotate exposed credentials and application encryption keys and review database access. Ordinary website visitors have no device update to install for this flaw.","product":"Laravel Livewire","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-54068"],"tags":["laravel","livewire","php","remote-code-execution","credential-theft","actively-exploited"],"affected":["livewire/livewire 3.0.0-beta.1 through 3.6.3, where components have the configuration described in the advisory; its affected-version field inconsistently states <3.6.3"],"fixed":["livewire/livewire 3.6.4 or later"],"matches":[],"sources":[{"kind":"advisory","title":"Livewire remote command execution during property update hydration","url":"https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3","by":"Livewire","date":"2025-07-17"},{"kind":"advisory","title":"CVE-2025-54068 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2025-54068","by":"NVD","date":"2026-06-17"},{"kind":"news","title":"CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026","url":"https://thehackernews.com/2026/03/cisa-flags-apple-craft-cms-laravel-bugs.html","by":"The Hacker News","date":"2026-03-21"},{"kind":"advisory","title":"Livewire: sfruttamento attivo in rete della CVE-2025-54068","url":"https://csirt.regione.toscana.it/livewire-sfruttamento-attivo-in-rete-della-cve-2025-54068-al01-260603-csirt-ita/","by":"CSIRT Toscana, republishing CSIRT Italia","date":"2026-06-03"},{"kind":"research","title":"CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised","url":"https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/","by":"Imperva","date":"2026-06-23"}],"started":"2026-03-20","closed":"2026-06-23","created":"2026-11-03T22:29:24.888Z","updated":"2026-11-03T22:29:24.888Z","cve_notes":[{"cve":"CVE-2025-54068","name":"Remote code execution in Livewire component updates","what":"Incorrect handling of component property updates in Livewire 3 through 3.6.3 lets unauthenticated remote attackers run commands in certain component configurations.","severity":"critical","cvss":9.2}],"timeline":[{"at":"2026-06-23","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Imperva reported stolen credentials from 6,167 distinct applications across multiple countries and sectors. The attackers’ infrastructure held more than 1,850 database dumps and email lists containing over 26 million addresses.","url":"https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/","by":"Imperva","patch":null},{"at":"2026-06-03","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Italy’s CSIRT warned of active exploitation and urged operators to update vulnerable installations.","url":"https://csirt.regione.toscana.it/livewire-sfruttamento-attivo-in-rete-della-cve-2025-54068-al01-260603-csirt-ita/","by":"CSIRT Toscana, republishing CSIRT Italia","patch":null},{"at":"2026-05-24","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Imperva observed and blocked attacks against Laravel Livewire applications. Its subsequent investigation connected the traffic to a campaign stealing application credentials.","url":"https://www.imperva.com/blog/cve-2025-54068-laravel-livewire-credential-theft-campaign-6000-applications-compromised/","by":"Imperva","patch":null},{"at":"2026-03-20","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set an April 3 remediation deadline for covered US federal agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2025-54068","by":"NVD","patch":null},{"at":"2025-07-17","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Livewire disclosed CVE-2025-54068 and confirmed a fix in 3.6.4. Certain Livewire 3 configurations allow remote attackers to run commands without logging in.","url":"https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3","by":"Livewire","patch":"patched"}],"url":"https://hard.fyi/live/laravel-livewire-code-injection-attacks-mar-2026/","json":"https://hard.fyi/api/live?id=laravel-livewire-code-injection-attacks-mar-2026"}