PHP Core
PHP 8.5.11 Patches 11 CVEs, Including a SOAP Server Crash
PHP 8.5.11, 8.3.35, and 8.2.34 fix 11 CVEs, including an unauthenticated SoapServer crash and HTTP redirects that leak Authorization headers.
Eric L. Barnes
Security
Every story tagged #security.
Vulnerabilities and advisories affecting PHP and the packages around it, with what is affected and what to do about it.
Packages
Laravel Vet: Spot Malicious Code in Composer Updates
Laravel Vet shows you the code each Composer update adds before it reaches vendor/, and fails your build on any package nobody has reviewed yet.
Eric L. Barnes
Community
Composer After the Attack: A SymfonyCon 2026 Talk
Composer's creators take the SymfonyCon stage to share what a year of Packagist supply chain attacks taught them, and what changed in Composer 2.10 and 2.11.
Eric L. Barnes
Developer Tools
Socket Adds PHP and Composer Security Scanning
Socket now scans PHP and Composer dependencies for CVEs, malicious packages, and reachable vulnerabilities through its Packagist support.
Eric L. Barnes
PHP Core
PHP 8.6 Session Defaults: SameSite, HttpOnly, Strict Mode
PHP 8.6 enables strict session mode and HttpOnly cookies by default, while setting SameSite to Lax. Here is what applications should check.
Eric L. Barnes
Applications
XSS2Shell: WordPress Pre-Auth RCE Starts in strip_tags()
WordPress 7.0.3 patches CVE-2026-64638, a pre-auth XSS to RCE chain that begins with a parser disagreement between PHP's strip_tags() and KSES.
Eric L. Barnes
PHP Core
PHP 8.5.9 Fixes a Postgres SQL Injection and Three More CVEs
PHP 8.5.9 is a security release patching a Postgres SQL injection in pg_insert(), a BCMath out-of-bounds write, and Phar and GD CVEs.
Eric L. Barnes
PHP Core
PHP 8.5.8 Fixes an OpenSSL CVE and a SOAP Regression
PHP 8.5.8 patches a memory corruption CVE in openssl_encrypt with AES-WRAP-PAD, restores SoapServer::handle() without raw input, and fixes three Opcache bugs.
Eric L. Barnes