New in Symfony 8.1: Forms Improvements
Symfony 8.1 brings many improvements to the Form component, including new features for multi-step forms and quality-of-life options for some form types. Form Flows Improvements…
Lire
A Week of Symfony #1013 (May 25–31, 2026)
A Week of Symfony #1013 (May 25–31, 2026)
This week, Symfony 8.1 was released. In addition, we published dozens of security advisories and released the security updates Symfony 5.4.53, 6.4.41, 7.4.13, 8.0.13, Twig 3.27, Symfony UX 2.36 and 3.1, and Polyfill 1.38.1. We also published more information…
Lire
Twig 3.27.1 released
Twig 3.27.1 released
Twig 3.27.1 is a patch release that fixes two regressions introduced by the sandbox hardening shipped in 3.27.0. Both involve how the sandbox inspects values that can be coerced to a string, and both are transparent once you upgrade. Typed iterable arguments…
Lire
SymfonyOnline June 2026: Building MCP Servers with the Official PHP SDK
SymfonyOnline June 2026 is just around the corner on June 11-12, 2026. Get ready for high-quality pre-recorded talks followed by live Q&As! 🎤 Speaker announcement! JoWe are happy to host Tobias Nyholm, Eneba, presenting "Building MCP Servers…
Lire
SymfonyOnline June 2026: Hunting Vulnerabilities in Symfony with LLMs
We are thrilled to welcome the global Symfony community online on June 11-12, 2026, for SymfonyOnline June 2026. Get ready for deep-dive technical tracks! 🎤 Speaker announcement! Join Vincent Amstoutz, Lead Dev, Speaker & OSS Contributor, for…
Lire
Symfony 8.1 curated new features
Symfony 8.1 curated new features
Symfony 8.1.0 is about to be released. As for any other Symfony release, our backward compatibility promise applies and this means that you should be able to upgrade easily to 8.1 without changing anything in your code. During the last couple of months, we've…
Lire
Symfony 8.1.0 released
Symfony 8.1.0 released
Symfony 8.1.0 has just been released. Check the New in Symfony 8.1 posts on this blog to learn about the main features of this new stable release; or check the first beta release announcement to get the list of all its new features. Read the Symfony upgrade…
Lire
CVE-2026-49212: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-49212: LiveComponentHydrator HMAC checksum lacks component and slot binding
Affected versions Symfony versions >=2.8.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description In symfony/ux-live-component,…
Lire
CVE-2026-49216: XSS in symfony/ux-autocomplete via unescaped AJAX response data
CVE-2026-49216: XSS in symfony/ux-autocomplete via unescaped AJAX response data
Affected versions Symfony versions >=2.2.0, =3.0.0, <3.1.0 of the Symfony UX Autocomplete component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description The Stimulus controller shipped…
Lire
CVE-2026-49208: Format-less date LiveProps parsed with the permissive DateTime constructor
CVE-2026-49208: Format-less date LiveProps parsed with the permissive DateTime constructor
Affected versions Symfony versions >=2.8.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description When a #[LiveProp] is typed…
Lire
CVE-2026-49215: CSRF Protection Bypass in symfony/ux-live-component: Accept Header is CORS-Safelisted
CVE-2026-49215: CSRF Protection Bypass in symfony/ux-live-component: Accept Header is CORS-Safelisted
Affected versions Symfony versions >=2.22.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description When using symfony/ux-live-component,…
Lire
CVE-2026-49211: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
CVE-2026-49211: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Affected versions Symfony versions >=2.2.0, =3.0.0, <3.1.0 of the Symfony UX Autocomplete component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause()…
Lire
CVE-2026-49210: XSS in symfony/ux-live-component via attacker-controlled child component tag
CVE-2026-49210: XSS in symfony/ux-live-component via attacker-controlled child component tag
Affected versions Symfony versions >=2.8.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml()…
Lire
CVE-2026-49209: Denial of service in symfony/ux-live-component via unbounded batch action requests
CVE-2026-49209: Denial of service in symfony/ux-live-component via unbounded batch action requests
Affected versions Symfony versions >=2.5.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke()…
Lire
SymfonyOnline June 2026: Giving voice to your agents, the Symfony AI way
Save the date! SymfonyOnline June 2026 will take place online on June 11-12, 2026, with 15 expert speakers streaming directly to you. 🎤 Speaker announcement! Guillaume Loulier, Technical Expert, SensioLabs, will be taking the virtual stage to present…
Lire