One of the most satisfying (and most frustrating!) parts of pentesting is spending an hour setting up the perfect PoC, composing shock-value screenshots, and writing a succinct report - only for them to spend 30 seconds making a trivial code change that fixes the issue. 😈😱

SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it safely. securinglaravel.com/security-tip... #Laravel

Security Tip: Do You Know Your SameSite Cookies?

[Tip #133] SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it…

securinglaravel.com

Elon demanding a 'historically accurate' Odyssey is like a child demanding a historically accurate Smurfs movie.

Received some great feedback from a client recently, and it really highlights why I specialise in PHP & Laravel as a pentester: "The fact that you understand both security *and* the frameworks I’m building with is such a big advantage over other firms that I’ve worked with." 🥰

What do you get when you combine an API, SameSite=None, and a Session cookie? securinglaravel.com/in-depth-thr... #Laravel

In Depth: Three Reasonable Decisions, One Critical Vulnerability

[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?

securinglaravel.com

Working on a fun In Depth article for Securing Laravel at the moment. 😈 The tagline is: What do you get when you combine an API, SameSite=None, and a Session cookie? Any guesses?

Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting. securinglaravel.com/security-tip... #Laravel

Security Tip: Have You Heard Of Slopsquatting?

[Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.

securinglaravel.com

Recently finished an audit for one of my oldest clients, this was #5! 🕵️ By far the most rewarding part of my job is working with the same clients each year, seeing their apps grow, and their commitment to security strengthen. It's not just a compliance checkbox, it's part of their culture.

Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷 securinglaravel.com/security-tip... #Laravel

Security Tip: Safely Updating Dependencies

[Tip #131] Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷

securinglaravel.com

Things Claude says... > Is that concerning? For local files it's not a vuln — it's theater > Is it TOFU? No — weaker than TOFU Ouch.

Nobody cares about security until they suddenly care about nothing else... A breach, a near miss, an awkward client question, and it's suddenly top priority! Get ahead. I do Laravel Security Audits & Pentests, ideally on a quiet day, not the worst one. 🕵️ valorinsecurity.com

We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈 securinglaravel.com/in-depth-ver... #Laravel

In Depth: Version Numbers Are Vanity Labels

[In Depth # 40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking,…

securinglaravel.com

If you've been shipping AI-written Laravel code lately (and let's be honest, you probably have), it's worth getting a human to actually read it! Reach out for an Audit/Pentest for the parts of your codebase that vibed a little too hard. 🕵️ valorinsecurity.com

I've got some capacity opening up over the next few months, so If you've been meaning to get a security audit / pentest done on your Laravel app - now is the time! 🕵️ 👉 DM or valorinsecurity.com

With Supply Chain Attacks, you often don't realise you've been compromised until it's already too late. And yet Canary Tokens - exactly the early warning you want - are hardly mentioned. They let you know the moment someone's sniffing around. securinglaravel.com/security-tip...

Security Tip: Canary Tokens

[Tip#31] These are my favourite simple security trick to let you know if someone is poking around in your stuff.

securinglaravel.com

I may have gone to Japan and spent more time looking for these than sightseeing... maybe... (Technically I went sightseeing while looking for these, so it counts as sightseeing time, right?)

📦 Composer 2.10 is out. Native malware filtering via @aikidosecurity.bsky.social (enabled by default on Packagist), a unified config.policy framework for advisories/abandoned/malware, and source fallback now deprecated. blog.packagist.com/composer-2-1... #php #phpc #composerphp

It's apt then that in my inbox today is a email from @valorin.bsky.social with his latest security tip - securinglaravel.com/security-tip... and then the release of Laravel Moat by @nunomaduro.com - laravel.com/blog/moat-a-...

Security Tip: Secure Your Repositories with Laravel Moat

[Tip #130] Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them.

securinglaravel.com

Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them. github.com/laravel/moat securinglaravel.com/security-tip... #Laravel

GitHub - laravel/moat: Moat reviews the security posture of your GitHub organization and repositories, then surfaces recommendations to consider.

Moat reviews the security posture of your GitHub organization and repositories, then surfaces recommendations to consider. - laravel/moat

github.com

I love Signed URLs, but there is one very subtle trap you can accidentally fall into... securinglaravel.com/security-tip... #Laravel

Security Tip: The Signed URL Trap

[Tip #129] I love Signed URLs, but there is one very subtle trap you can accidentally fall into...

securinglaravel.com

Livewire's Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈 securinglaravel.com/in-depth-don... #Laravel

In Depth: Don't Trust Public Livewire Properties

[In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈

securinglaravel.com

On the Securing Laravel blog, @valorin.bsky.social explores Laravel security concepts & techniques 🔐 - madewithlaravel.com/securing-lar...

Again, if you have a Substack, the best time to switch away was months ago -- but today's the second best time.

kottke.org@kottke.org · 4mo ago

Hey, look at Substack promoting Andrew Tate as the #1 new bestseller. The company's amoral leadership & backers will platform anyone, even ludicrously toxic rapists & human traffickers.

Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data? securinglaravel.com/security-tip... #Laravel

Security Tip: Stop Putting Actions on GET Requests!

[Tip #128] Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?

securinglaravel.com

As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱 ❌ Bug fixes (they stopped 6 months ago) ❌ Security fixes (they stop today!) Have you upgraded yet? laravel.com/docs/release... #Laravel

Release Notes | Laravel 12.x - The clean stack for Artisans and agents

Laravel is a PHP web application framework with expressive, elegant syntax. We’ve already laid the foundation — freeing you to create without sweating the small things.

laravel.com

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access. securinglaravel.com/security-tip... #Laravel

Security Tip: Your JWT Might Be a Forever Key!

[Tip #127] Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

securinglaravel.com

Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error. securinglaravel.com/security-tip... #Laravel

Security Tip: Validate Config at Boot

[Tip #126] Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.

securinglaravel.com

PSA for @statamic.com folks - update your sites ASAP! ⚠️ A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱 All the details: cvereports.com/reports/CVE-...

CVE-2026-27593 - GitHub Advisory Database

Statamic is vulnerable to account takeover via password reset link injection

github.com

I am determined to get back to @laravellive.dk this year, so if you have a dev team or a meetup in EU or UK and want me to run a workshop or give a talk in August, let me know!

You can't trust an email address you haven't verified, so why are you storing them in your database? securinglaravel.com/in-depth-ema... #Laravel

In Depth: Email Verification Isn't as Simple as You Think

[In Depth #38] You can't trust an email address you haven't verified, so why are you storing them in your database?

securinglaravel.com