Security Notice
[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.
In Depth
[In Depth #43] What happens when you point an AI security scanner at an AI-built app? It finds a weakness in a fix AI confidently wrote months earlier. Let’s dig into reading AI findings critically. (Part 1 of 2)
Security Tips
[Security Tip #135] During a recent pentest, I suddenly got hit with 403s on every request. It wasn't a WAF - it was a clever little trap one of my clients built to catch anyone poking at Livewire. Let me show you how it works. 🤓
[In Depth #43] What happens when you point an AI security scanner at an AI-built app? It finds a weakness in a fix AI confidently wrote months earlier. Let’s dig into reading AI findings critically. (Part 1 of 2)
[In Depth #42] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈
[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?
[In Depth #40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈
[In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈
[In Depth #38] You can't trust an email address you haven't verified, so why are you storing them in your database?
The essential security resource for Laravel developers.
Yikes! I've been writing Securing Laravel for 5 years! 😲
[Tip #134] Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓
[In Depth #42] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code execution. Let's pull a real RCE apart. 😈
[Tip #133] SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it safely.
[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?
[Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.
[Tip #131] Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷
[In Depth #40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈
[Tip #130] Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them.
[Tip #129] I love Signed URLs, but there is one very subtle trap you can accidentally fall into...
[In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈
[Tip #128] Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?
