ThinPHP Blog: Understanding successful tracing of security vulnerabilities
29448
In this new post on the ThinkPHP blog, there's more talk about their Chorizo! security scanner and how, with a little help from their Morcilla product, you can find problems easily. Now, interpreting them is another matter, so they show you a simple way to determine just what went wrong.   Sometimes it's not very easy to check if a vulnerability occured where Morcilla told you it occured. In order to pinpoint this issue, it is neccessary that you get a deeper look to the callstack of all the functions that were involved calling the SQL abstraction layer.   They include a screenshot of how the functionality will (in the upcoming version) work in the case of a MySQL SQL injection problem.
134164
Script down to the core Security researchers have begun a month-long project to highlight security flaws in PHP, the popular scripting language.â¦
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
325308
This week's edition of PHP Magazine's PHPBarnstormer has been released - Issue #22.
612223
Thin-client computing has been around for a decade, but the rising costs of updating software and installing security patches on networked personal computers is sparking renewed interest
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
150840
Backdoor drafts, security moms and up-armoring
285360
Blog: Researcher shows how URLs can be spoofed and content arbitrary within Safari 3.0 beta.
366947
Lukas Smith is sending a wakeup call to the internet providers and web hosters out there - get involved in the PHP community!   We do not seem to have any ISP's active inside the PHP community. This is kind of odd, considering that PHP seems to be driving the business of hosters quite a bit. Why have none of them decided that PHP is important enough for their business that its worthwhile to ensure that their interests are taken into account?   He makes the suggestion of passing along the suggestion to bosses/co-workers/anyone who'll listen about getting involved. Suggested places to start would be as a part of the testers group or even contributing to the migration guide.
350929
As Ed Finkler points out there's a new article posted (written by him) on the C7Y site (from php|architect) talking about his Inspekt library - an introduction to the filtering library showing how to help make your applications safer.   Inspekt is a library for PHP4 and PHP5 that aims to make safe input handing easier, and unsafe actions more difficult. Inspekt establishes a new development approach by wrapping input within "cage" objects, and requiring the developer to use validation and filtering methods to test and manipulate the input data. This article provides a brief introduction to Inspekt and its capabilities.   The article covers all of the basics - what the library can do for you, how it integrates into your application and how it helps to protect you from potential problems with the data in your superglobals ($_GET, $_POST, $_REQUEST, etc).
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
590366
Virtualized rootkits - Part 2 &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
759946
Researchers in the U.S. say they've successfully shown how attackers could compromise a network designed to make it harder to trace Web sites they are viewing.
391310
Internet Security Systems' intrusion prevention software on Crossbeam Systems security switches.
353737
News, Infocus, Columns, Vulnerabilities, Bugtraq ...
710202
Blanket Discovery for Stolen Laptops &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29