What Laravel Forge says
Forge security advisory says Forge's automatic security updates do not patch PHP; the customer must update PHP on every server (every installed PHP version) via the dashboard or SSH. Forge says patched packages usually reach its repositories shortly after the upstream release but may lag. Advisory page shows no publish date; it references the 2026-10-21 PHP release.
Laravel Forge's automatic security updates do not patch PHP.Check the PHP version
SSH: php8.4 -v (substitute version); list installed versions with ls /etc/php; php-fpm8.4 -v confirms the FPM binary.
Update PHP
Dashboard: server > PHP tab (Runtime > PHP), version dropdown > 'Update PHP X.X', confirm; repeat for every installed version. Manual SSH: sudo apt-get update; apt-cache policy php8.4-fpm (Candidate must match the fixed version); sudo apt-get install --only-upgrade -y -o Dpkg::Options::="--force-confold" $(dpkg -l 'php8.4*' | awk '/^ii/ {print $2}'). Packages come from packages.sury.org/php (Ubuntu 26.04) or ppa.setup-php.com (22.04, 24.04). Forge says PHP 8.1 and earlier will not receive an official fix.
Restart PHP
Package upgrade restarts PHP-FPM. Forge advises restarting long-running CLI processes (queue workers, Horizon, Octane, Reverb, background processes), e.g. php artisan queue:restart, php artisan horizon:terminate, php artisan octane:reload. If FPM did not restart: server dashboard actions dropdown > 'Restart PHP X.X'.