Developer Tools
Socket Adds PHP and Composer Security Scanning
Socket now scans PHP and Composer dependencies for CVEs, malicious packages, and reachable vulnerabilities through its Packagist support.
Eric L. Barnes
Security
Every story tagged #security.
Vulnerabilities and advisories affecting PHP and the packages around it, with what is affected and what to do about it.
PHP Core
PHP 8.6 Session Defaults: SameSite, HttpOnly, Strict Mode
PHP 8.6 enables strict session mode and HttpOnly cookies by default, while setting SameSite to Lax. Here is what applications should check.
Eric L. Barnes
Applications
XSS2Shell: WordPress Pre-Auth RCE Starts in strip_tags()
WordPress 7.0.3 patches CVE-2026-64638, a pre-auth XSS to RCE chain that begins with a parser disagreement between PHP's strip_tags() and KSES.
Eric L. Barnes
PHP Core
PHP 8.5.9 Fixes a Postgres SQL Injection and Three More CVEs
PHP 8.5.9 is a security release patching a Postgres SQL injection in pg_insert(), a BCMath out-of-bounds write, and Phar and GD CVEs.
Eric L. Barnes
PHP Core
PHP 8.5.8 Fixes an OpenSSL CVE and a SOAP Regression
PHP 8.5.8 patches a memory corruption CVE in openssl_encrypt with AES-WRAP-PAD, restores SoapServer::handle() without raw input, and fixes three Opcache bugs.
Eric L. Barnes