@valorin@phpc.social

· 36mo ago

One of my favourite (and oh so simple) hacker tricks is to abuse JSON support in APIs and pass TRUE instead of the actual API key. If the code does loose comparison, you don't need the key! 😎 😈 🍿
https://securinglaravel.com/p/security-tip-type-juggling #PHP #Laravel

Security Tip: Watch Out for Type Juggling

Security Tip: Watch Out for Type Juggling

[Tip#26] Type Juggling is still very much a problem.

909

21

572

0

· 3mo ago

Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting. https://securinglaravel.com/security-tip-have-you-heard-of-slopsquatting/ #Laravel

Security Tip: Have You Heard Of Slopsquatting?

Security Tip: Have You Heard Of Slopsquatting?

[Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.

12

1

10

0

· 2mo ago

Um... that's not how risks work... 🤦 This is the rubbish being peddled by big companies selling "Cyber Insurance". 😡

1

0

· 3mo ago

Recently finished an audit for one of my oldest clients, this was #5! 🕵️ By far the most rewarding part of my job is working with the same clients each year, seeing their apps grow, and their commitment to security strengthen. It's not just a compliance checkbox, it's part of their culture. I've got some capacity coming up, so if you'd like security to be part of your culture too, let's make that happen! Reach out or head over to https://valorinsecurity.com

Laravel Security Audits and Penetration Tests – Stephen Rees-Carter

Looking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

2

0

1

0

· 8mo ago

It's been 4 months, a lot has happened, but I'm finally back to writing securinglaravel.com!

New Security Tip coming out in a few hours...

9

5

0

· 2mo ago

Replying to

@thomas@phpc.social I'm hoping to get to more of them next year, I've had to pull back a bit this year.

1

0

https://laravel.com/docs/releases#support-policy #Laravel

· 7mo ago

As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱

❌ Bug fixes (they stopped 6 months ago)
❌ Security fixes (they stop today!)

Have you upgraded yet?

Laravel

Release Notes | Laravel 13.x - The clean stack for Artisans and agents

Laravel is a framework for building modern web apps and AI agents. Expressive syntax, built-in tools, and everything you need to ship fast.

6

0

5

0

· 3mo ago

Working on a fun In Depth article for Securing Laravel at the moment. 😈 The tagline is: What do you get when you combine an API, SameSite=None, and a Session cookie? Any guesses?

1

4

0

https://securinglaravel.com/in-depth-dont-trust-public-livewire-properties/ #Laravel

· 5mo ago

Livewire's Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈

In Depth: Don't Trust Public Livewire Properties

[In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈

3

0

3

0

· 7mo ago

PSA for Statamic folks - update your sites ASAP! ⚠️ A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱 All the details: https://cvereports.com/reports/CVE-2026-27593 #Laravel

cvereports.com

CVE-2026-27593: Statamic's 'Choose Your Own Adventure' Password Reset

A critical vulnerability in Statamic CMS turns the password reset feature into an account takeover weapon. By injecting a malicious base URL into the reset request, attackers can force the system to email valid users a link that sends their reset token directly to the attacker's server.

3

0

9

0

https://securinglaravel.com/security-tip-how-should-apis-respond-to-http/ #Laravel

· 12mo ago

If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands? 🤔

Security Tip: How Should APIs Respond to HTTP?

[Tip #123] If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands?

7

2

5

0

https://securinglaravel.com/security-tip-stop-putting-actions-on-get-requests/ #Laravel

· 6mo ago

Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?

Security Tip: Stop Putting Actions on GET Requests!

[Tip #128] Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?

2

0

2

0

https://securinglaravel.com/in-depth-email-verification-isnt-as-simple-as-you-think/ #Laravel

· 7mo ago

You can't trust an email address you haven't verified, so why are you storing them in your database?

In Depth: Email Verification Isn't as Simple as You Think

[In Depth #38] You can't trust an email address you haven't verified, so why are you storing them in your database?

2

0

3

0

https://securinglaravel.com/security-tip-the-signed-url-trap/ #Laravel

· 5mo ago

I love Signed URLs, but there is one very subtle trap you can accidentally fall into...

Security Tip: The Signed URL Trap

[Tip #129] I love Signed URLs, but there is one very subtle trap you can accidentally fall into...

1

0

https://securinglaravel.com/security-tip-dont-forget-to-regenerate-2fa-secret-keys/ #Laravel

· 12mo ago

Do you reset your 2FA secret keys when a user toggles TOTP off/on?

It's not just passwords you need to worry about when it comes to authentication and stolen credentials: if an attacker can steal a 2FA secret key, they'll always have a valid TOTP! 😱

Security Tip: Don't Forget to Regenerate 2FA Secret Keys!

It's not just passwords you need to worry about when it comes to authentication and stolen credentials: your 2FA secret keys may also be at risk!

3

0

1

0

https://securinglaravel.com/security-tip-your-jwt-might-be-a-forever-key/ #Laravel

· 7mo ago

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

Security Tip: Your JWT Might Be a Forever Key!

[Tip #127] Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

1

0

4

0

· 10mo ago

Exhausted after #LaraconAU last week, but excited by how it all went!

I was so proud of everyone in my workshop on Wednesday - everyone had a go, and the excitement in the room as they hacked through challenges made it all worth it.

And my talk on Friday was the most absurd and crazy thing I've done on stage (which is saying something), and I've had some great feedback that's already made it worth it. No idea what I'll do next year...

2

0

https://securinglaravel.com/security-tip-do-you-have-a-permissions-policy/
#Laravel

· 12mo ago

Laravel Security Tip: Do You Have a Permissions Policy?

What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them?

Security Tip: Do You Have a Permissions Policy?

[Tip #85] What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them?

2

0

1

0

· 12mo ago

Haven't bought tickets to my Pre-Laracon AU Security Workshop yet?! 😲

I'll be locking in numbers early next week, so get your ticket TODAY or reach out to me directly. ⌛

This is your final warning... ⏰
https://events.humanitix.com/lets-hack-pre-laracon-security-workshop

#Laravel #LaraconAU

events.humanitix.com

"Let's Hack!" Pre-Laracon Security Workshop

Attending Laracon AU? Come along to "Let's Hack!" the day before, for a fun and interactive Laravel Security Workshop by Stephen Rees-Carter!

1

0

https://securinglaravel.com/security-tip-what-is-an-httponly-cookie/ #Laravel

· 12mo ago

Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does?

Security Tip: What Is An HttpOnly Cookie?

[Tip #86] Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does?

1

0

· 2mo ago

What do you get when you combine an API, SameSite=None, and a Session cookie? https://securinglaravel.com/in-depth-three-reasonable-decisions-one-critical-vulnerability/ #Laravel

In Depth: Three Reasonable Decisions, One Critical Vulnerability

In Depth: Three Reasonable Decisions, One Critical Vulnerability

[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?

0

· 3w ago

How does everyone feel about pentest findings/reports available online (behind auth), as opposed to emailed or sent via Slack/Teams? I've always been wary of putting them online, even behind auth, but I can see some benefits - especially with agents doing the remediation work.

0

6

0

@yojimbo@masto.hackers.town

· 3w ago

Replying to

From whom are they being protected?

Protected from someone finding their way into my system and accessing my client's details and vulns.

Who is the target audience for a report?

Whoever my client gives access - usually we set up a channel with the dev team, and I report findings directly to them. I don't think I've had a client gatekeep my work from their team before.

0

3

0

https://securinglaravel.com/security-tip-update-your-packages-yes-this-again

· 8mo ago

I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again...

Security Tip: Update your packages! (Yes, this again!)

[Tip #124] I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again...

0

· 2mo ago

Replying to

@thomas@phpc.social No 😭

0

2

0

https://securinglaravel.com/security-tip-validate-config-at-boot/ #Laravel

· 7mo ago

Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.

Security Tip: Validate Config at Boot

[Tip #126] Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.

0

· 2w ago

Replying to

This article has gone in a direction I didn't expect - a PR into the framework itself! Should be a fun read by the time I'm finished, and will probably end up being a 2-parter.

0

· 7mo ago

Replying to

@bobmagicii@phpc.social CLI is definitely overlooked too. Limited security risks given they'd have access to the code though. 🤔

0

1

0

· 3mo ago

Replying to

@willpower232@phpc.social Yep. 🤣

0

https://securinglaravel.com/security-tip-consider-all-routes-not-just-web/

· 8mo ago

routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one?

Security Tip: Consider All Routes, Not Just Web!

[Tip #125] routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one?

0

1

0

· 12mo ago

"Let's Hack!", my Pre-Laracon Security Workshop is just FIVE weeks away! 🎉
(So is @LaraconAU... but let's be honest, priorities.)

Only 11 tickets left, & I need to confirm numbers with the venue, so if you've been thinking about it, now's the time!
👉 https://events.humanitix.com/lets-hack-pre-laracon-security-workshop

events.humanitix.com

"Let's Hack!" Pre-Laracon Security Workshop

Attending Laracon AU? Come along to "Let's Hack!" the day before, for a fun and interactive Laravel Security Workshop by Stephen Rees-Carter!

0