Tag archive
A critical Laravel flaw lets attackers sign in as an existing user on apps that use the built-in token API guard with MySQL or MariaDB. Are you affected, how to patch to 12.68.0 or 13.29.0, and a stopgap if you cannot update today.
A technical, practical remediation guide for site administrators and sysadmins responding to PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619. Covers patch verification, legacy mitigation, and server hardening.
On 21 October 2026 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix PHP2Shell, two critical remote code execution flaws now being exploited. What they are, who is most exposed, how to patch and verify, and what to do if you cannot update today.
PHP 8.2 gets its last security fixes on 31 December 2026. What end of life means, whether to move to PHP 8.3, 8.4 or 8.5, what changes on the way, and a five-step upgrade plan with the tools to scan your code.
PHP composer security is a serious part of modern PHP application security because most PHP projects...
Production php.ini settings for security and performance: error handling, expose_php, OPcache, session cookies, upload and runtime limits, and headers.
A hands-on guide to PHP security with copy-ready code: prepared statements, context-aware escaping, CSRF tokens, Argon2id hashing with rehashing, session and php.ini hardening, safe uploads, security headers and a one-afternoon audit.
Security is not a product, but a process.- Bruce Schneier, Security Technologist File uploads are...