PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Security review of PHP documentation

blog.quarkslab.com | research | #php | #secure-coding | #documentation | #audit | #security-review | #ostif
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab's security review of PHP's official documentation: auditing code snippets and user comments for insecure examples, prioritizing filesystem and cryptography for OSTIF and the PHP Foundation.
Published
Collected

Related coverage

blog · blog.trailofbits.com
How to prepare for a security review
Trail of Bits' guide to preparing for a security review: set clear goals, fix compiler warnings and test coverage, remove dead code, and document thoroughly so auditors focus on real risks.
blog · netspi.com
IT Manager's guide to passing the PA-DSS Audit
A NetSPI guide for IT managers on PA-DSS validation: what the standard requires, the documentation and testing involved, and pre-audit steps like removing prohibited data and securing log activity.
research · blog.quarkslab.com
Cortex Security Audit
Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
research · blog.quarkslab.com
Scala Security Audit
Quarkslab's security audit of Scala 3 for OSTIF: threat modeling, manual review, static analysis and fuzzing across the compiler, standard library, REPL, TASTy Inspector and doc generator.
research · blog.quarkslab.com
Paramiko Security Audit
Quarkslab's security audit of Paramiko for OSTIF covered the pure-Python SSHv2 library, its cryptography dependencies and rust-openssl bindings, entropy sources, constant-time code, testing and CI/CD.
Back