Modern PHP Security Part 2: Breaching and hardening the PHP engine
We go into specific bugs that can get around the PHP engine’s security boundaries, and tips on additional security layers that will lessen the damage when breached.
PHP
Investigation of PHP Web Shell Hexedglobals.3793 Variants
Our guest blogger and Detectify Crowdsource hacker 5w0rdFish details her research on Hexedglobals.3793 family of PHP-based malware and the de-obfuscation process. This article covers the …
Stealing files from web servers by exploiting a popular PDF generator
TCPDF is one of the most popular PHP libraries for creating PDF documents. “TCPDF is now one of the world’s most active Open Source projects, used daily by millions of users and included in thousands of CMS and Web applications.”
Do you dare to show your PHP easter egg?
The first mention of this specific “attack vector” was disclosed back in 2004 at the seclists.org webappsec mailing list. It appears that a few of the PHP developers smuggled in hidden URL’s which would show various graphics and credits to the authors of involved in the PHP project. Rumors have circulated around how bad it really is. Most developers doesn’t know of it’s existence, some see it as a funny feature, some mistakes it as being harmless, while others see it as a potential threat to their IT environment. The catch is, there is no publicly available tool to evaluate how bad and widespread the problem really is.