Laravel Announcements from Laracon US 2026

Taylor Otwell walked through the new starter tooling in Boston just over a month ago. It confirmed something we've believed for years as a Laravel agency: the framework keeps getting faster to build with, without asking folk to rip up what already works.

The headline releases centred on tighter tooling, better performance defaults, and first-class support for AI, all shipped in a way that protects existing projects.

Key Takeaways

• Laravel Cloud's new scale-to-zero Flex compute wakes a dormant app, database and cache in under 500 milliseconds, roughly 20 times faster than the previous 10 second cold start, so staging and internal tools stop costing money while nobody is using them.

• Managed queues now run on isolated compute and scale back to zero when the queue empties, with idle workers waking in under a second instead of around 30 seconds.

• The Laravel AI SDK's new human-in-the-loop API lets you approve, deny or modify an agent's tool calls before it acts, which is the single feature that makes AI agents defensible in a regulated organisation.

• Laravel Private Cloud is now HIPAA certified alongside SOC 2 Type II, GDPR and PCI-DSS, on fully isolated AWS infrastructure with static outbound IPs.

• Next.js and Nuxt frontends can now deploy from the same repository as your Laravel backend, on one bill and one set of team permissions.

Scale-to-zero means you stop paying for idle Laravel apps

Most applications are not busy around the clock. Staging environments, internal admin tools, member portals used heavily on weekday mornings and barely at all overnight, they all sit idle far more than they run.

Until now you paid for that idle time anyway.

The rebuilt scale-to-zero Flex compute puts compute, database and cache to sleep together and wakes them in under 500 milliseconds.

That architecture originally shipped for Postgres. It now covers MySQL too, with a configurable idle window from one minute to an hour (or never, if you'd rather the thing stayed awake). Storage stays mounted the whole time, so nothing is lost when compute suspends.

For a membership organisation running a production site, a staging environment, a members' area and a couple of internal tools, this is a genuine line-item reduction.

We've had plenty of conversations where a client is paying for four environments and only really using one. If you're weighing up a move, our Laravel Cloud migration team can model what your current setup would cost after the switch.

Managed queues keep heavy jobs away from your members

Background jobs are where most member platforms quietly fall over. Bulk renewal emails, CPD certificate generation, data syncs with a legacy CRM, they all compete with live web traffic for the same resources.

Laravel Cloud's managed queues put workers on isolated compute, entirely separate from your application cluster, scaling on queue depth.

The improvements since launch are the interesting part. Idle workers now wake in under one second, down from roughly 30. First-in, first-out queues let you enforce strict ordering for anything where sequence matters, payments and ledger updates being the obvious examples. Long-running jobs of up to an hour are supported on the new Pro class.

The dashboard lists every failed job with the reason it failed and a one-click retry. That sounds small until you've spent an afternoon digging through logs to work out why 400 renewal reminders didn't send.

We built the CRiS platform for the National Caravan Council on this kind of architecture, where background processing has to run reliably without ever slowing the thing members actually touch. Queue infrastructure that scales itself is a straightforward win there.

Laravel and AI: the human-in-the-loop API is the one that matters

Plenty of teams have had a go at AI agents over the past two years. Most stopped when they realised an agent running on autopilot could do something they couldn't undo.

The Laravel AI SDK now has a human-in-the-loop (HITL) API. You intercept specific agent actions and require a decision before the agent proceeds, so you can approve, deny or modify a tool call rather than finding out afterwards.

That changes the risk calculation entirely. An agent that drafts a member communication and waits for sign-off is useful. An agent that sends it unsupervised is a liability.

A few other additions are worth knowing about:

• Built-in filesystem tools, so agents can read and write files without you building that integration.

• A summarise() method on the Str helper, using the cheapest model on your configured provider by default. Pair it with an Eloquent observer and a summary field updates itself whenever content changes.

• Multimodal embeddings for images and audio, which makes semantic search across a media library possible rather than relying on filenames and tags.

• Support for any OpenAI-compatible provider, not just OpenAI.

Laravel Boost also now infers your project's own coding conventions and journals its decisions, so agents working in your codebase follow your team's patterns rather than a generic average. If the topic is new to you, Laravel for the Rest of Us covers the fundamentals without the jargon.

Your frontend and backend can now live in one place

Most Laravel APIs don't stand alone. They're usually paired with a Next.js or Nuxt frontend that has needed its own hosting, its own pipeline and its own invoice.

Laravel Cloud now deploys both from the same repository. Connect a repo, Cloud detects whether it holds one application or several, and you create a separate Cloud application for each, rooted at its own directory.

Each keeps its own environment variables, scaling settings and domains. They share a single bill and a single set of team permissions.

There's a secrets manager to go with it. Define a secret once at organisation level, link it to as many environments as you need, and Cloud injects it at deploy time. Values are encrypted client-side and never shown again once saved, so rotating a credential means writing a new value once and redeploying.

Compliance: Private Cloud is now HIPAA certified

For organisations holding sensitive member data, this release opens doors that were shut before.

Laravel Private Cloud gives you your own AWS account, your own VPC, a dedicated Kubernetes cluster and static outbound IPs you can hand to third-party APIs for allowlisting. No shared surface area with another customer.

HIPAA certification now joins SOC 2 Type II, GDPR and PCI-DSS. Healthcare software, university platforms and government teams can run on dedicated infrastructure with full tenant isolation and the SSO provider you already use.

Private Cloud customers can also install additional software into the build image as add-ons, things like media processing libraries, monitoring agents or a headless browser for generating PDFs, without maintaining a custom Dockerfile.

We've built video consultation tooling for Vet Help Direct and a community platform for XLVets, and in both cases the security questions arrived early having the certificates in place makes these sorts of conversations quicker.

What we'd actually do with this

If you already run on Laravel, three things are worth putting in front of your team this quarter.

Move non-production environments onto Flex compute and see what falls off the bill. Run composer update and redeploy if you're on managed queues, so you pick up the sub-second worker wake times. And if AI is on your roadmap, build your first agent with the HITL API from day one rather than retrofitting approval later.

None of this requires a rebuild. That's the point.

The thread running through Laracon US 2026 is that Laravel keeps removing work without breaking what came before, which is exactly what you want from a framework you've committed a platform to. You're going to want the queue changes first. Our services and articles go into more depth if you want it.

Do I need to upgrade my Laravel app to use the new Laracon US 2026 features?

Most of the framework features need a Laravel version upgrade, but the Laravel Cloud features work on existing applications. If you already use managed queues, running composer update and redeploying picks up the faster worker wake times without any code changes.

How much can scale-to-zero actually save on hosting?

It depends on how much of your infrastructure sits idle. Organisations running a production site plus staging, internal tools and demo environments typically see the biggest saving, because those non-production environments are unused most of the week and now cost nothing while dormant.

Is it safe to let an AI agent make changes in our codebase?

With the Laravel AI SDK's human-in-the-loop API, yes, because you can require approval before an agent executes a tool call. You intercept the action, then approve, deny or modify it, so nothing irreversible happens without a person signing it off.

Should we move to Laravel Cloud or stay on our current hosting?

Laravel Cloud makes most sense if you are running several environments, doing heavy background processing, or managing infrastructure with a small team. If you have a dedicated DevOps function and a heavily customised AWS setup, the case is weaker and worth modelling before you commit.

What is Laravel Private Cloud and do we need it?

Laravel Private Cloud gives you fully isolated infrastructure: your own AWS account, VPC, dedicated Kubernetes cluster and static outbound IPs. You need it if your compliance requirements rule out shared infrastructure, for example HIPAA, PCI-DSS or strict public sector procurement rules.

Can we host our React or Vue frontend on Laravel Cloud too?

Next.js and Nuxt frontends can now deploy from the same repository as your Laravel backend, each as its own Cloud application with separate environment variables and domains. They share one bill and one set of team permissions, and more languages and frameworks are on the way.