Security Notice
[Notice #6] The patches landed, the servers (just) survived, and the disclosure fell apart around them. Here’s the full round-up in one place - where to find the details, how to get patched, and the chaos that made a hard day harder.
Security Notice
[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.
In Depth
[In Depth #43] What happens when you point an AI security scanner at an AI-built app? It finds a weakness in a fix AI confidently wrote months earlier. Let’s dig into reading AI findings critically. (Part 1 of 2)
[In Depth #43] What happens when you point an AI security scanner at an AI-built app? It finds a weakness in a fix AI confidently wrote months earlier. Let’s dig into reading AI findings critically. (Part 1 of 2)
[In Depth #42] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈
[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?
[In Depth #40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈
[In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈
[In Depth #38] You can't trust an email address you haven't verified, so why are you storing them in your database?
The essential security resource for Laravel developers.
[Security Tip #135] During a recent pentest, I suddenly got hit with 403s on every request. It wasn't a WAF - it was a clever little trap one of my clients built to catch anyone poking at Livewire. Let me show you how it works. 🤓
Yikes! I've been writing Securing Laravel for 5 years! 😲
[Tip #134] Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓
[In Depth #42] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈
[Tip #133] SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it safely.
[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?
[Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.
[Tip #131] Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷
[In Depth #40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈
[Tip #130] Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them.
[Tip #129] I love Signed URLs, but there is one very subtle trap you can accidentally fall into...
[In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈
