Laravel Livewire Vulnerability Exposes Over 6,000 Apps

A critical unauthenticated RCE in Laravel Livewire (CVE-2025-54068, CVSS 9.8) is being actively exploited to inject PHP objects during hydration, allowing attackers to execute commands, deploy a stealer script (shoc.enz), harvest .env files, database dumps, payment keys and credentials across over 6,000 applications (26M+ emails stolen); patch to Livewire 3.6.4 immediately and rotate exposed credentials.