PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PHP Date Handling: Subtle Pitfalls Subtracting Months

hackerone.com | blog | #php | #tutorial | #laravel | #coding-pitfalls | #carbon | #date-handling
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Carbon's subMonth() overflows on month-end dates—subtracting a month from December 31st lands on December 1st—so HackerOne recommends startOfMonth() or subMonthNoOverflow() to avoid the surprise.
Published
Collected

Related coverage

blog · hackerone.com
Common PHP/Laravel Pitfalls: Understanding Array Slicing
A common PHP/Laravel pitfall: array_slice and Collection::slice take a length as the second argument, unlike end-index slicing in JavaScript and Python, causing subtle off-by-one bugs.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Hardening Your Laravel Applications: Tips for Secure Session and Cookie Management
Laravel ships solid session and cookie management, but misconfiguration can still expose sessions. This guide walks through hardening encryption, expiration, and secure cookie settings.
blog · hackerone.com
Slow Rolling Refactors in Laravel: Ensuring a Smooth Transition
A HackerOne engineering post advocates gradual refactoring in Laravel: small reversible changes, starting with the slowest database queries, and automated PHPUnit and Dusk tests as a safety net.
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · xbow.com
PHP2shell: Patch Today, Then Prove It
The PHP Project just shipped fixes for the vulnerability dubbed PHP2shell. Step one is to patch, confirm it took, and make a plan for anything too old to patch.
Back