Getting sqlmap to abuse a Livewire endpoint is a wonderful way to relax after a stressful week. 😈

If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @thephpf.bsky.social

Sponsor The PHP Foundation

The PHP Foundation — Supporting, Advancing, and Developing the PHP Language

thephp.foundation

Didn’t want to shill my stuff during the chaos or in my Security Notices, but now things have calmed down (I hope!): I do Laravel & PHP Security Audits & Pentests. If PHP2Shell has you wondering what’s hiding in your own apps, I can help. valorinsecurity.com

The patches landed, the servers (just) survived, and the disclosure fell apart around them. Here’s the full round-up in one place - where to find the details, how to get patched, and the chaos that made a hard day harder. securinglaravel.com/security-not... #Laravel

Laravel Security Notice: Critical PHP Security Release - The Day After

[Notice #6] The patches landed, the servers (just) survived, and the disclosure fell apart around them. Here’s the full round-up in one place - where to find the details, how to get patched, and the…

securinglaravel.com

How'd we all go overnight? I'm catching up on everything that's happened since my last and will put together an article with all the details I can find, if you want to know more about *waves hands* this. Let's agree to not do this again for a while, yeah?

Ok folks, I'm switching off for the night. It's after 3am here and I need to do the school run in a few hours. Good luck to everyone still updating servers and untangling updates! Hopefully it's a quiet night of updates and checking version numbers. 🤞

for others reading this: securinglaravel.com/laravel-secu... Instead of waiting for the 22.04 and 24.04 updates to land in the Launchpad PPA, you can switch repos to the version here: packages.sury.org/php/README.txt This is confirmed by the Laravel team as safe for Forge servers.

Laravel Security Notice: Critical PHP Security Release ⚠️

[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.

securinglaravel.com

The patches should be available on Laravel Forge servers on 26.04 LTS, which use the packages.sury.org package repository, but 24.04 and 22.04 use the Launchpad PPA, which hasn't been updated yet.

And it's up! www.php.net github.com/php/php-src/... github.com/php/php-src/... I don't think the Ubuntu repos are updated yet, but they shouldn't be too far away.

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

php.net

For the Forge users, I've just published Update #5 to my post about the PHP CVEs thanks to Kath Young. The Forge API includes an endpoint for pushing patches for PHP versions: laravel.com/forge/docs/a... securinglaravel.com/laravel-secu...

Laravel Security Notice: Critical PHP Security Release ⚠️

[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.

securinglaravel.com

Laravel just posted an update about patching on Cloud, Forge, and Vapor over on Twitter: x.com/laravel/stat...

Ironically, this is one of the few times I'm happy Securing Laravel isn't on PHP. I'll be keeping my post updated with everything I know, with no risk of it going down due to patching or attacks. securinglaravel.com/laravel-secu...

Laravel Security Notice: Critical PHP Security Release ⚠️

[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.

securinglaravel.com

PHP folks, please don't rely on the ini config change to protect your apps. It won't help when the full details are out - it only protects against a single vector, if that. You need to apply the patches as soon as they drop. phpc.social/@joepferguso...

Honestly, it's pretty disappointing to see responsible disclosure fail like this. It takes a lot of effort to release a critical patch. Leaking the announcement or publishing a PoC before a scheduled patch shows you have no ethics and are only interested in credit for yourself.

A Critical PHP Security Release is coming in 13 hours - you need to be ready to patch your servers. securinglaravel.com/laravel-secu... #Laravel

Laravel Security Notice: Critical PHP Security Release ⚠️

[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.

securinglaravel.com

What happens when you point an AI security scanner at an AI-built app? It finds a weakness in a fix AI confidently wrote months earlier. Let’s dig into reading AI findings critically. securinglaravel.com/in-depth-aud... #Laravel

In Depth: Auditing Your App with Claude’s Security Plugin

[In Depth #43] What happens when you point an AI security scanner at an AI-built app? It finds a weakness in a fix AI confidently wrote months earlier. Let’s dig into reading AI findings critically.…

securinglaravel.com

I can't believe I'm using the ridiculously Aussie phrase "She'll be right!" in a security article, but here we are. 🤷

🧙

Not a bad view to write a new In Depth article. 😎 I'm doing a walkthrough of the results from Claude's security plugin on one of my projects, looking at the quality of the findings and how we can identify the real risks from the noise.

How does everyone feel about pentest findings/reports available online (behind auth), as opposed to emailed or sent via Slack/Teams? I've always been wary of putting them online, even behind auth, but I can see some benefits - especially with agents doing the remediation work.

During a recent pentest, I suddenly got hit with 403s on every request. It wasn't a WAF - it was a clever little trap one of my clients built to catch anyone poking at Livewire. Let me show you how it works. 🤓 securinglaravel.com/security-tip... #Laravel

Security Tip: The Trap That Caught Me!

[Security Tip #135] During a recent pentest, I suddenly got hit with 403s on every request. It wasn't a WAF - it was a clever little trap one of my clients built to catch anyone poking at Livewire.…

securinglaravel.com

Just scheduled my next Security Tip. Feels nice to be scheduling them in advance again, rather than posting late! 😎 This is a rather fun one too: a story from a recent pentest where the client's defences caught me!

How can you level up as a PHP / Laravel focused web developer in a world where software engineering becomes increasingly focused on security? Step 1: Sign up to @valorin.bsky.social's Securing Laravel newsletter. Congrats on an epic 5 years Stephen! Still some of the best content on the topic.

Yikes! I've been writing Securing Laravel for 5 years! 😲 securinglaravel.com/5-years-of-s... #Laravel

5 years of Securing Laravel!

Yikes! I've been writing Securing Laravel for 5 years! 😲

securinglaravel.com

Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓 securinglaravel.com/security-tip... #Laravel

Security Tip: Help Password Managers Get It Right!

[Tip #134] Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓

securinglaravel.com

I've been struggling with mental and physical health issues for the past few years, and one of the things that really helped this year was finding a hobby away from technology where I get to work with my hands. Here's what I've been doing: pottery.valorin.net

Gallery - Pottery by Stephen

Handmade pottery by Stephen — every piece thrown, glazed & fired by hand.

pottery.valorin.net

unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈 securinglaravel.com/in-depth-fro... #Laravel

In Depth: From Serialised String to RCE!

[In Depth #41] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code…

securinglaravel.com

Submitted my first CVEs directly to MITRE due to an unresponsive package maintainer for a very popular package that sits at #5 for a common search term on Packagist. Will be interesting to see how this goes.

Um... that's not how risks work... 🤦 This is the rubbish being peddled by big companies selling "Cyber Insurance". 😡

One of the most satisfying (and most frustrating!) parts of pentesting is spending an hour setting up the perfect PoC, composing shock-value screenshots, and writing a succinct report - only for them to spend 30 seconds making a trivial code change that fixes the issue. 😈😱