A rather serious risk is silently existing in Laravel use communities (PHP frameworks are common worldwide). By simply disclosing the APP_KEY code (the security key used by Laravel to encrypt data), hackers can easily gain remote control of users’ servers.

b913f23a3ddd8b83d2cc.jpg​

More worryingly, hundreds of thousands of APP Key KEY keys have been publicly leaked on GitHub, of which at least 600 active Laravel applications have been identified as exploitable.

Between 2018 and May 2025, experts extracted over 260,000 APP Key keys from GitHub. Over 600 apps were found to be vulnerable to attack with more than 10,000 keys being unique and at least 400 usable keys.

In Laravel, APP_KEY is a random 32-byte sequence generated upon application installation, usually located in the.env file. It is used for:

  • Encrypt/decode sensitive data,
  • Sign and authenticate cookie session,
  • Create a login token and handle other security functions.

If the hackers get the APP KEY, they can:

  • Generate or decode session cookies, forge access permissions.
  • exploits the deserialization error in Laravel’s decrypt() function for Remote Code Execution.

How did hackers perform attacks?

  1. Hackers search for leaked APP_KEY on GitHub (or public platforms).
  2. Combined with information about the APP URL (also commonly revealed in.env files), they can directly access the running application.
  3. Send a payload of dangerous encoding (gadget chain) to the server.
  4. Laravel automatically decodes and deserializes payloads, resulting in remote execution of code without passing application logic or logging in.

This allows hackers to bypass all application logic protections and take over control of web servers.

Practical Implications: Not Just Laravel

  • 63% of exposed KEY APPs come from.env files, which often contain additional sensitive information such as:
    • Database connection information
    • Cloud service token (AWS, Google Cloud…)
    • API key related to chatbot, AI, customer support, e-commerce, etc..
  • More than 28,000 APP KEY + AAPP URL pairs are exposed at the same time and at least 10% of them are valid and eligible for direct exploitation.

Special points to consider

  • Laravel no longer has this error by default, but it reverts if the dev uses SESSION_DRIVER=cookie and handles decrypt() carelessly.
  • The error involved PHP object deserialization, which was widely exploited with tools such as phpggc – which helped attackers create custom “gadget chains” to insert malicious code.

Recommendation for protection of Laravel systems and related applications​

  1. Never commit a “.env” file to GitHub or any public source code repository.
  2. If Detected Opened APP Key:
    • Not just erase from repo.
    • Rotate APP Key lock immediately.
    • Update all systems using the old key with the new key.
  3. Do not use SESSION DRIVER=cookie unless risk is understood.
  4. Deploy continuous secret surveillance in CI/CD, container, Docker image, log pipeline…
  5. Use secret security scanning tools such as GitGuardian or automated secret detection platforms to track repo and infrastructure.

Laravel’s story is just the tip of the iceberg. In the context of the explosion of CI/CD, Docker, AI and microservices, the protection of sensitive information (secret management) should be considered a security pillar rather than a sub-step in the software development process. Leakage of APP_KEY or any token. No longer a “little bug” but a direct threat to data, customers, and corporate infrastructure.

The Hacker News​