Laravel Livewire code-execution flaw CVE-2025-54068 exploited for credential theft
Attackers are exploiting Laravel Livewire CVE-2025-54068 to steal website credentials and databases. Website operators should update to 3.6.4 or later and investigate possible compromise. Visitors have no device update to install.
If you run a website, ask its developer or hosting provider to update Livewire to 3.6.4 or later and check for compromise. If compromise is suspected, have them rotate exposed credentials and application encryption keys and review database access. Ordinary website visitors have no device update to install for this flaw.
What’s happening
CVE-2025-54068 affects Livewire, software used to build Laravel websites. Certain configurations let remote attackers run commands without authentication or user interaction. Earlier major versions are unaffected. Livewire’s description includes 3.6.3, although its affected-version field excludes that release; 3.6.4 is the confirmed fix, with no known workaround. CISA listed the flaw as exploited on 20 March 2026. Imperva subsequently investigated a credential-theft campaign and reported credentials from 6,167 applications, including payment, cloud, email and database secrets. Recovered database dumps showed that stolen credentials had also been used to extract data. Victims spanned businesses, healthcare, education and government. As at 3 November 2026, the software fix remains available, but these sources do not establish that the campaign has ended or that every affected operator has been notified. Updating does not resolve credentials or data already stolen.
- What
- Flaw
- Affects
- Laravel Livewire
- Affected
- livewire/livewire 3.0.0-beta.1 through 3.6.3, where components have the configuration described in the advisory; its affected-version field inconsistently states <3.6.3
- Fixed in
- livewire/livewire 3.6.4 or later
- Since
- 20 Mar 2026
- Closed
- 23 June 2026
Timeline
- Wider attacks
Imperva reported stolen credentials from 6,167 distinct applications across multiple countries and sectors. The attackers’ infrastructure held more than 1,850 database dumps and email lists containing over 26 million addresses.
- Wider attacks
Italy’s CSIRT warned of active exploitation and urged operators to update vulnerable installations.
- Wider attacks
Imperva observed and blocked attacks against Laravel Livewire applications. Its subsequent investigation connected the traffic to a campaign stealing application credentials.
- CISA added
CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set an April 3 remediation deadline for covered US federal agencies.
- Made publicFixed
Livewire disclosed CVE-2025-54068 and confirmed a fix in 3.6.4. Certain Livewire 3 configurations allow remote attackers to run commands without logging in.
Sources
- Livewire remote command execution during property update hydrationLivewire · 17 July 2025
- CVE-2025-54068 DetailNVD · 17 June 2026
- CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026The Hacker News · 21 Mar 2026
- Livewire: sfruttamento attivo in rete della CVE-2025-54068CSIRT Toscana, republishing CSIRT Italia · 3 June 2026
- CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications CompromisedImperva · 23 June 2026