Secunia.com: SUSE update for PHP
563007
Secunia has release a new advisory for SUSE linux users to point them to the update of the PHP packages on their system to correct a highly critical issue.   SUSE has issued an update for php. This fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious people to disclose potentially sensitive information, to bypass certain security restrictions, to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.   Operating systems included in the advisory are systems running SUSE Linux, UnitesLinux, and openSUSE linux. Package updates are linked from the advisory so you can quickly and easily update your packages.
360234
On his blog, William Candillon mentions an upcoming release of his apsect-based framework for PHP - phpAspect.   I have two weeks of holidays very soon, there will be dedicated to the release of phpAspect. Basically, I need to clean up some piece of code and finish to write the documentation.   Keep an eye on the project's page (on the Google Code Hosting service) for the update.
277304
The results from the latest poll conducted by the International PHP Magazine have been released. This time, they asked developers what they thought was the best way to do QA for their PHP applications.   Among the options were things like "Do API documentation", "Use code analyzers that check CS violations, XSS or SQL injection attacks" and the number one choice - "Do unit tests using PHPUnit or phpt". Three other options followed behind (using debugging tools, code analyzers and having a commit mailing list) with the API documentation falling down in last place.   They already started up this week's poll too. This time, they ask developers to vote on which of the options make for good PHP code. There's four options - structured, consistent, portable and secure. Get your vote in today!
261062
Latest PHPClasses.org Releases:SPL and IteratorsBWT & MTF encodercPanel Sub-domains CreatorObserverableHTTP SpySimple and Attachment Send MailWindows RegistryClean OutputCryptPHP RARRTF Generation ClassBar ChartPclTemplateICQ Protocol
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
289622
According to this new advisory from Secunia today, the SuSE linux group has released a new package update for the PHP4 distribution on their operating system:   SUSE has issued an update for php4. This fixes some vulnerabilities and a weakness, where one has an unknown impact and the others can be exploited by malicious, local users to gain escalated privileges, and by malicious, local users and malicious people to bypass certain security restrictions.   The issue is marked as "Less critical" but it's still a good idea to update, especially when it relates to security issues. You can find more information at the original advisory on the Novell site.
224992
The latest release of PHP in the PHP 5.2.x series has been posted for download to the main PHP website today - version 5.2.3.   The PHP development team would like to announce the immediate availability of PHP 5.2.3. This release continues to improve the security and the stability of the 5.X branch as well as addressing two regressions introduced by the previous 5.2 releases. These regressions relate to the timeout handling over non-blocking SSL connections and the lack of HTTP_RAW_POST_DATA in certain conditions. All users are encouraged to upgrade to this release.   Updates in this new version include many security fixes and enhancements - check out the Changelog for complete information.   Check out other comments on the release from Ilia Alshanetsky and Stefan Esser.
153432
rPath linux has issued an update to their packages for PHP, PHP-MySQL and PHP-PGSql to correct issues that could make it possible for a remote user to gain unauthorized access.   his fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions or by malicious people to potentially compromise a vulnerable system.   References and links to the update information can be found in their original advisory.
647305
Popular posts from PHPDeveloper.org for the past week:Ian Selby's Blog: Uploading Large Files With PHPONLamp.com: Quick and Clean PHP FormsDotVoid.com: Reordering nested sets using PHP and JavascriptRob Allen's Blog: Zend Framework Book Coming SoonCommunity News: php|works Daily Summaries (Day 2)Community News: Sara Golemon & Christopher Jones - First Day Summaries of php|worksJob Posting: University of Wisconsin, Department of Medicine Seeks Web Developer (Madison, WI)Zend Developer Zone: PHP Abstract Podcast Episode 19: Glue Frameworks vs. Full Stack FrameworksStefan Mischook's Blog: Installing PHP and MySQL on the Mac with MAMPSecurityReason: Three Advisories for PHP 5.2.4 (dl, iconv_substr & setlocale)
579691
Latest PEAR Releases:HTTP_Session 0.5.6PEAR_Info 1.7.0PEAR_PackageFileManager_Cli 0.3.0Math_Fraction 0.4.1QA_Peardoc_Coverage 1.1.0PHP_DocBlockGenerator 1.0.2
728050
According to this security release from Secunia, there's a cross-site scripting vulnerability with the Travelsized CMS package (PHP-based) in the main index file.   David Vieira-Kurz has discovered some vulnerabilities in Travelsized CMS, which can be exploited by malicious people to conduct cross-site scripting attacks.   The problem comes from the input parameters "page" and "langauge" not being verified and sanitized. Users are encouraged to go in and manually edit the source to correct the problem as there is no patch currently posted as of yet. You can get complete information about this issue from the full Secunia report.
304159
Antony Dovgal has pointed out the updated packages that have been released to the snaps.php.net website by Derick Rethans.   He also includes a list of things that will be included in this upcoming release like:   Namespaces Late static binding Accessing static members through $foo::myFunc() Improved OpenSSL extension PCRE 7.4   Grab your copy of these latest snapshots from the snaps website and get to testing them on your system to see what happens before the release.
416446
Ilia Alshanetsky has noted that the latest release canidate for the PHP 5.2.x series, PHP 5.2.5RC1, is now available for download.   This RC includes a fair number of fixes since our last release and predominantly works on improving the stability of the 5.2 tree as well as including a small number of minor security fixes. I'd like to ask everyone to test this release against your code and setups, we are aiming for a quick release cycle and user feedback is critical for a successful release.   You can download this new edition directly from here (no Windows builds yet).
642167
Newly posted over on PHP Magazine's website is this week's latest PHPBarnstormer - Issue #11
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
553060
From the group that brings you Chorizo! and Morcilla, the latest in PHP security tools, is a video showing how to find and correct the issues that your script might have on the server side (with the help of Morcilla).    This video shows you how Morcilla, our brand new PHP extension, lets Chorizo! have a look inside your application on the server.   We are able to hook into every PHP function and trace the payloads of Chorizo!. By default, Morcilla hooks into the whole MySQL function family, fopen, mail, include/require/include_once/require_once, preg_* and others. With a ZendEngine patch, we are able to trace unset variables and a lot more.     The video (basically a screen capture of the process) is a bit hard to read in the smaller version, so it's recommended to view the larger size if you want to see the options. It's interesting, though, to see how it picks out the errors and tells what they are and where you can go to fix them (like a file inclusion issue, as they demonstrate).
737792
As mentioned in this new advisory on the Secunia website, the Slackware linux group has posted their latest updates to their PHP package (in light of the released of PHP 5.2.4).   Slackware has issued an update for php. This fixes a weakness and some vulnerabilities, where some have unknown impacts and others can be exploited by malicious users and malicious, local users to bypass certain security restrictions.   The update is marked as "moderately critical" so it's recommended that you update as soon as possible. The packages can be downloaded from the Slackware website (from the FTP sites they link to in the original advisory).