Curated security research, vulnerabilities, advisories and tools for practitioners.

#php

Security coverage tagged php.

1.

Chamilo LMS... It's raining 0days, hallelujah, it's raining 0days

blog | 2026-08-31 22:00 | blog.quarkslab.com | original ↗ | #rce | #php | #0day

2.

dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoC

research | 2026-08-30 05:15 | CVE-2026-82222 | github.com | original ↗ | #rce | #php | #wordpress

3.

CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout

tool | 2026-08-06 17:05 | CVE-2026-17543 | github.com | original ↗ | #public-poc | #data-exposure | #php

4.

Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql

research | 2026-07-06 11:06 | swarm.ptsecurity.com | original ↗ | #vulnerability-research | #memory-safety | #denial-of-service

5.

Packagist is now protected by Aikido Intel and other updates to the PHP registry

blog | 2026-06-26 00:00 | aikido.dev | original ↗ | #supply-chain | #threat-intelligence | #malware

6.

Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer

incident | 2026-05-23 00:00 | aikido.dev | original ↗ | #cloud | #supply-chain | #credential-theft

7.

Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP

research | 2026-05-15 09:09 | swarm.ptsecurity.com | original ↗ | #vulnerability-research | #memory-safety | #php

8.

The Fragile Lock: Novel Bypasses For SAML Authentication

research | 2026-01-21 10:34 | portswigger.net | original ↗ | #appsec | #ruby | #authentication-bypass

9.

Security review of PHP documentation

research | 2025-09-21 22:00 | blog.quarkslab.com | original ↗ | #php | #secure-coding | #documentation

10.

Dùng AI để tìm bug - Phần 1: Tìm SQL Injection trong PHP

vulnerability | 2025-07-16 09:41 | blog.viettelcybersecurity.com | original ↗ | #ai-security | #bug-bounty | #php

11.

Auditing Moodle's core hunting for logical bugs

research | 2025-04-21 22:00 | blog.quarkslab.com | original ↗ | #php | #vulnerability | #pentest

12.

Security audit of PHP-SRC

research | 2025-04-09 22:00 | blog.quarkslab.com | original ↗ | #fuzzing | #php | #audit

13.

Impossible XXE in PHP

research | 2025-03-11 14:49 | swarm.ptsecurity.com | original ↗ | #php | #web-security | #xxe

14.

Pwn everything Bounce everywhere all at once (part 2)

research | 2025-02-25 23:00 | blog.quarkslab.com | original ↗ | #rce | #php | #sql-injection

15.

Pwn everything Bounce everywhere all at once (part 1)

research | 2025-02-24 23:00 | blog.quarkslab.com | original ↗ | #rce | #php | #red-team

16.

‘Hacking is essentially about curiosity’: Blaklis on the art and science of Bug Bounty hunting

blog | 2024-12-19 08:18 | yeswehack.com | original ↗ | #bug-bounty | #php | #interview

17.

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

research | 2024-11-18 14:02 | yeswehack.com | original ↗ | #bug-bounty | #php | #sandbox-escape

18.

Exploiting Chamilo during a Red Team engagement

research | 2024-09-16 22:00 | blog.quarkslab.com | original ↗ | #rce | #php | #red-team

19.

From opcode to code: how AI chatbots can help with decompilation

research | 2024-07-30 14:02 | swarm.ptsecurity.com | original ↗ | #ai-security | #php | #reverse-engineering

20.

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

blog | 2024-07-19 15:29 | yeswehack.com | original ↗ | #pentesting | #php | #docker

21.

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

blog | 2024-07-09 13:33 | yeswehack.com | original ↗ | #ai-security | #bug-bounty | #rce

22.

Why we’re stoked to partner with Laravel

blog | 2024-07-08 00:00 | aikido.dev | original ↗ | #appsec | #php | #partnership

23.

Critical RCE vulnerability in PHP CGI: everything you need to know

vulnerability | 2024-06-10 17:08 | CVE-2024-4577 | wiz.io | original ↗ | #rce | #php | #ransomware

24.

How Serialized Cookies Led to RCE on a WordPress Website

blog | 2024-05-09 16:11 | hackerone.com | original ↗ | #bug-bounty | #rce | #nextcloud

25.

Exploiting GLPI during a Red Team engagement

vulnerability | 2024-03-20 23:00 | blog.quarkslab.com | original ↗ | #php | #sql-injection | #red-team

26.

Hardening Your Laravel Applications: Tips for Secure Session and Cookie Management

blog | 2024-03-15 03:06 | hackerone.com | original ↗ | #php | #web-security | #cookies

27.

Identifying and Remediating CWE-312 Cleartext Storage of Sensitive Information in Laravel Applications

incident | 2024-02-16 03:02 | hackerone.com | original ↗ | #code-review | #php | #secure-coding

28.

PHP deserialization attacks and a new gadget chain in Laravel

research | 2024-02-12 23:00 | blog.quarkslab.com | original ↗ | #php | #deserialization | #vulnerability

29.

The Fallacy of Overreliance on Traits in PHP: Unmasking Poor Class Design

blog | 2024-01-10 09:18 | hackerone.com | original ↗ | #php | #code-quality | #dependency-injection

30.

Embracing CarbonImmutable in PHP: A Shift Towards Reliable Date and Time Management

blog | 2023-12-27 10:34 | hackerone.com | original ↗ | #php | #best-practices | #carbon-immutable