CVE-2026-71537: Php Laravel Non Atomic Credit Refund Racecve-2026-71537-php-laravel-non-atomic-credit-refund-race
Non-atomic credit/refund minting (TOCTOU race): a model-instance financial balance is incremented by abs($AMOUNT) (or a negated amount) without wrapping the guard check ("no pending record"), the record persist, and this increment in a single DB::beginTransaction()/DB::commit() unit, and without re-fetching the guarded rows with lockForUpdate(). Concurrent d
