Think-PHP Blog: Detect and fix security vulnerabilities on server side within seconds
553060
From the group that brings you Chorizo! and Morcilla, the latest in PHP security tools, is a video showing how to find and correct the issues that your script might have on the server side (with the help of Morcilla).    This video shows you how Morcilla, our brand new PHP extension, lets Chorizo! have a look inside your application on the server.   We are able to hook into every PHP function and trace the payloads of Chorizo!. By default, Morcilla hooks into the whole MySQL function family, fopen, mail, include/require/include_once/require_once, preg_* and others. With a ZendEngine patch, we are able to trace unset variables and a lot more.     The video (basically a screen capture of the process) is a bit hard to read in the smaller version, so it's recommended to view the larger size if you want to see the options. It's interesting, though, to see how it picks out the errors and tells what they are and where you can go to fix them (like a file inclusion issue, as they demonstrate).
49129
Over on the SecurityFocus website, there's an interview posted with Stefan Esser of the Hardened-PHP Project (as interviewed by Federico Biancuzzi.   Federico Biancuzzi discussed with him how the PHP Security Response Team works, why he resigned from it, what features he plans to add to his own hardening patch, the interaction between Apache and PHP, the upcoming "Month of PHP bugs" initiative, and common mistakes in the design of well-known applications such as WordPress.   Some of the topics discussed include  the Hardened-PHP Project Suhosin the PHP Security Response Team (his role in it and why he left) PHP5's security focus versus PHP4's and more...  Check out the full interview to have all of your questions answered.
127648
Latest PHPClasses.org Releases:AShellPassword Generator & CheckerBPT_SessionManagerSubmit SecurityFTP Folder Copy or DeleteOcheck classIniInteractionBPT_LoggerPostgreSQL Backup and RestoreXML2Array_xmlreaderClaseDateTimeManagerPDO_EXTpopupMsgClase DateTimeManagerLiveValidationPHP
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
23541
This week's latest PHPBarnstormer has been posted.
274361
Stop the WordPress Bloging software organisation WordPress has warned that hackers posted compromised versions of its open source software after breaking into one of the servers behind its website.â¦
767454
PHP Magazine has a new posting today about an article from WebProNews.com concerning a new article - Generate HTML Files With PHP To Reduce The Server Load.
86222
In brief Exploit circulating for unpatched vuln
87931
Latest worm poses a risk to many Web sites using the PHP scripting language.
424439
10.3.7 fixes bugs, fills security holes
763765
PHP Security From The Inside &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
194115
On the PHP Security Blog, there's three new posts that Stefan Esser has written up that demonstrate some of the more destructive uses of Javascript that he's found:  JavaScript/HTML Portscanning and HTTP Auth Bruteforcing HTTP Auth in Firefox with JavaScript JavaScript Scanning and expose_php=On    While the first two are interesting, it's the last of these that most directly applies to PHP. He gives a simple "proof of concept" that checks to see if the embedded image is the correct "size" to be related to a webserver running PHP with the expose_php setting set to "on".
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
692223
Jim Plush has posted an offifical release announcement about his latest contribution to the PHP community - a debugging tool combining PHP (through the myBIC framework) and the Firefox FireBug extension.   I put together a couple pieces of technology to give the PHP community a debugger/profiler that should make life easier in the "web2.0" world. Are you tired of echo'ing print statements in your ajax calls? Writing to log files? Firing up big ol debuggers just to see what the value of some array is? Well look no further than the new MyBic PHP Debugger.   The tool is a smaller part of his larger MyBIC framework and can do things like writing log files, echo information back out to the screen, and communicate information back out to the Firefox user. There is a standalone version of FireBug that will be posted for those that don't want to have to install an entire framework to use it.   Keep an eye out (here and on his blog) for the links to the release when it's posted. In the meantime, you can check out a screencast [mov] of the package in action or just the screenshots in the blog entry.
388816
Popular posts from PHPDeveloper.org for the past week:Dave Dash's Blog: nginx and symfonyZend Developer Zone: The ZendCon Sessions Episode 6: Project Management Methods to Maintain IT StandSitePoint PHP Blog: Tokenization using regular expression sub patternsIT Jobs Watch: Results for PHP Developers in LondonJob Posting: Digital River Seeks PHP Developer (Eden Prairie, MN)Dan Scott's Blog: Oooh...looks like I've got (even more) work cut out for meLeon Chevalier's Blog: Improve website load time by 500% with 3 lines of codePHPWomen.org: elePHPantsPhil Thompson's Blog: 7 PHP functions that saved my lifeStuart Herbert's Blog: Using suphp To Secure A Shared Server
193310
Here's what was popular in the PHP community one year ago today:onPHP5.com: Clickable, Obfuscated Email AddressesJacob Santos' Blog: PHP BlackjackThe Bakery: RESTful Web Services With CakePHPDeveloper.com: Developing a Ajax-driven Shopping Cart with PHP and PrototypeGreg Beaver's Blog: Mac OS X ships with security hole-laden PEAR - how to upgrade immediatelyNexen.net: English Articles and a Single Distribution ResourceJob Posting: Red Ventures Seeks Several LAMP Developers (Charlotte, NC)The Bakery: Checking for duplicate records (unique record)DevShed: The Basics of Abstract Factory Classes in PHP 5NewsForge.com: A DIY calendar control in PHPDevGuide.net: Dynamic Bitmap Graphics with PHP and GDRichard Heyes' Blog: Browser DetectionInternational PHP Magazine: Poll Question: Which is the Most Important Feature of PHP 5?Builder.au: Dynamic XML document construction with the PHP DOMCommunity News: PEAR Version 1.5.0 Released