PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reports from the Field: Part 2

bishopfox.com | blog | #php | #web-security | #attack-chaining | #git-config | #source-code-exposure | #credential-recovery
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Four ways an exposed .git/config file can be exploited: rebuilding repository contents, recovering hardcoded credentials, and finding vulnerabilities like PHP eval() issues leading to shell access.
Published
Collected

Related coverage

blog · bishopfox.com
Reports from the Field: Part 3
Reports from the field: an open-source URL tool surfaced leaked VPN credentials, which combined with social media reconnaissance and microservice discovery enabled deep internal access.
blog · bishopfox.com
Reports from the Field: Part 1
Real-world attack chaining: credentials recovered from a WordPress backup were reused across systems, ultimately unlocking an email marketing platform with 1.7 million subscribers.
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · xbow.com
PHP2shell: Patch Today, Then Prove It
The PHP Project just shipped fixes for the vulnerability dubbed PHP2shell. Step one is to patch, confirm it took, and make a plan for anything too old to patch.
blog · about.gitlab.com
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
Back