Critical Flaw in Livewire Exposes Laravel Apps to Stealthy RCE, PoC Releases

A critical flaw in Livewire has been disclosed by security researchers, exposing Laravel-powered servers to remote code execution (RCE) via a stealthy PoC tool. The vulnerability, tracked as CVE-2025-54068, exploits Livewire’s hydration process and could affect over 130,000 applications worldwide, according to Synacktiv.

Although a patch has been released, the researchers warn that a fundamental design characteristic remains a ticking time bomb for apps with leaked credentials, and that bypassing the APP_KEY can still enable malicious object injection to trigger RCE. The flaw involves type juggling during component updates and a gadget chain around PHP’s unserialize() behaviour, with PoC tooling named Livepyre demonstrated for exploitation both with and without the APP_KEY.

Users are urged to upgrade Livewire to the latest version (3.6.4+) and to enforce strict typing on component properties while keeping the APP_KEY secure, as leaks or defaults can leave applications defenseless against attack.