Progress Report: October 2026

October was a month of two speeds. On the package side, just a handful of releases. On our own admin panel... we built something we lik...

October was a month of two speeds. On the package side, just a handful of releases. On our own admin panel... we built something we liked so much that we're launching it as an add-on today. But first, the boring-but-important stuff.

Maintenance

• CRUD - 2 updates (we're at v7.1.22)
• PRO - 2 updates (v3.0.32)
• Basset - 2 updates (v2.0.16)

Small stuff, but worth having: admins no longer get logged out on the latest Laravel releases, translated entries show the right language, the inline create operation and the air-datepicker field got fixes, and Basset's cache-busting string now changes when the file does.

PHP2Shell, or: upgrade in time

On October 21st the PHP team shipped emergency releases for two critical bugs in PHP itself, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Unauthenticated remote code execution, in every PHP version from 5.4 to 8.5, exploited in the wild within hours. The only real fix is to update PHP: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. If you haven't done that yet... stop reading and go do it. We'll wait.

Back? Good. Here's the takeaway for me. We used to tell people to upgrade all their dependencies once a year. That advice is outdated. Nowadays it looks like every 6 months, maybe every 3... plus whenever the world is burning, like right now. The projects that had a boring, repeatable upgrade routine patched PHP2Shell in an afternoon. The ones that were three major versions behind had a very bad week.

And while you're upgrading PHP, please update Backpack too. Our superhero Pedro has been pushing security fixes left and right this year, and the latest one landed in CRUD 7.1.21. A composer update after your PHP upgrade takes two minutes and gets you all of them.

New Add-on: Omnisearch

Here's how this one came to be. Our own admin panel has tens of thousands of users, invoices, tickets, articles... and the search bar at the top had become slow and clumsy. So we rebuilt it as a command palette: press Cmd+K (or Ctrl+K), type a few letters, get grouped results, use the arrow keys, hit Enter. Within a day we couldn't imagine working without it. Within a week we had pulled it out into a package. Today, we're launching backpack/omnisearch.

What it does:

• Search any Eloquent model. List the model, the columns and the permission in one config file. Multi-word terms must match every word. Exact matches on ids and numbers come first.
• Jump to any page. Every link in your sidebar menu becomes a shortcut, with its @can checks respected, so each admin only sees the pages they may open.
• Run actions. A shortcut can call a class of yours: clear a cache, queue a job, send a report. The palette asks for confirmation when you want it to and shows the result as a toast.
• Permissions enforced twice. The palette hides what the admin may not use, and the JSON endpoints check again.
• Fast and light. Vanilla JavaScript, one CSS file, two JSON endpoints. No Livewire, no extra JavaScript framework, no search service to run.
• Looks like your admin panel. It follows Tabler's CSS variables, so it works with dark mode and with every one of the new skins. And it speaks 7 languages out of the box.

It needs Backpack v7.1+ and the Tabler theme. Installing it is two commands: composer require backpack/omnisearch and php artisan omnisearch:install. Then you add your entities to config/backpack/omnisearch.php and press Cmd+K.

One more thing. Omnisearch is our first GOLD-exclusive add-on. You can't buy it on its own - it comes with every GOLD plan, for one project or for unlimited projects. If you're on an active GOLD plan, you already have access... go install it! If you're not, this is a pretty good reason to get one. And yes, "first" means there will be more: from now on, our most ambitious add-ons will be GOLD-only. We want GOLD to be more than "a bundle of everything"... we want it to be the best admin panel toolkit money can buy. For more info on Omnisearch, take a look at the product page.

Two new articles

We've also published two articles this month that aren't about new features:

• llms.txt and MCP didn't move the needle for us. Here's what did. - we did everything "AI-ready" the internet told us to. Most of it didn't help. A few things helped a lot. This is the ranked list.
• A free map field for Backpack, from the community - siberfx/backpack-leafletjs is a map field built on Leaflet, and I think more of you should know about it. It's also in our add-ons list now. If you've built a Backpack add-on we don't know about... tell us, we'd love to feature it.

Moving to auto-renew

If you bought a one-time bundle in the past, your account now shows an offer to move to a SILVER or GOLD auto-renew plan. We honor the time you already paid for: the first charge happens only when your current access would have expired, and you get a discount for making the move. Business customers: your EU VAT ID carries over to the new checkout, so you won't get charged VAT by mistake. If something doesn't look right on that page, reply to this email or open a ticket, and we'll sort it out by hand.

--

That's it for October 2026. No v8 news this month, but we're still collecting suggestions: if something bugs you in Backpack v7, or there's one thing you'd love to see in v8, comment below. Even a one-line answer helps.

Thanks for using Backpack - we couldn't do this without your support.

Cheers!