PHP exploit code plants itself in GIF
599984
Blog: Security researchers found PHP exploit code embedded in a GIF on a major image hosting site, slipping through the proverbial gates with the aid of a legitimate image at the beginning of the file, according to security researchers.
715118
In a new post to the JSLabs blog today, there's a mini-tutorial showing how to, with the help of the new hooks in PHP 5.2, create a file upload progress meter.   This progess meter is based on the yahoo user interface library and alternative php cache (APC).  You will need both of these for it to display properly.  PHP 5.2.0 or higher is also required. (I have written a previous article on alternative PHP cache here).   He gives a brief overview of how things work (including the php.ini setting to make it happen) and has a screenshot of the resulting output. You can check out the demo here or just grab the source and jump right in.
367211
Days after sample attack code for a yet-to-be-patched flaw surfaced, malicious sites are popping up that exploit the hole.
740094
In his travels as a PHP developer, Jamie Wong has gathered some helpful debugging tips that are shared in this latest post to his blog.   Here are some bugfixing rules and tips Iâve learned working all these years with PHP. I emphasize mostly on fixing bugs than preventing them, which is another subject worth of its own article. Iâve moved to Rails, but I wanted to finish this post as a farewell and thanks to every article and documentation that was useful to me. Hope this is useful to you too.   Topics covered include:  Assume nothing Turn Error Reporting to show all errors Read the error message Understand the bug "Scooby-Bug, where are you?" Get as much information as possible  Each has some explanation below it and, in some places, a bit of code to clarify the point.
711347
Code that exploits a "critical" Windows flaw has been posted on the Net, opening the door for a worm to be created.
634435
Andrei Zmievski has posted something new to his blog today about a feature of PHP6 that's finally been hammered down - HTTP input (request) decoding.   There have been no fewer than 4 different proposals floated before, but this one combines flexibility, performance, intuitiveness, and minimal architectural changes, and has only a couple of small drawbacks. Let's take a closer look.   He details the functionality - what it is, what's been decided on, and the advantages of the method. The basic approach is a "lazy" one where PHP will only store the request when it comes in, no filtering or anything, until you want to do something with it (i.e. get it via $_GET, $_POST, etc). When the request for data is made, PHP looks at the encoding settings and formats the data accordingly.   Advantages he mentions for this method include removing the guess-work on PHP's part for which encoding the request is and that it removes some of the overhead by not processing the data until it's actually needed.
323110
Code that exploits a weakness in the way many Microsoft applications process JPEG images has been published on the internet. Microsoft only discovered the security flaw, which could allow software viewing
347238
Hole allows attackers to create fake Web sites that look genuine.
750855
If you took the photo of a Chihuahua at  www.flickr.com/photos/benvoluto/216323527/, you have caused a  Web sensation.
48914
Sean Coates has created a simple version of a popular bit of Perl functionality and shares the code in hi slatest post - the "pie" ability to perform a search and replace, line by line, through a file using a regular expression.   I've often found myself looking for a PHP equivalent. Not to do simple substitutions, of course, but complex ones. And since I'm most comfortable with PHP, and a I have a huge library of snippets that I can dig out to quell a problem that I may have solved years ago, I've been meaning to fill this void for a while.   So, one evening, he came home and hashed out this version of the script. He includes the code in the post...it works on the command line and pulls in a file (though STDIN) and loops through the buffered version to perform the regex replace.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
345464
php|architect has a new note about a few PHP vulnerabilities:
87931
Latest worm poses a risk to many Web sites using the PHP scripting language.
121787
A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net.
150896
In yet another "security via randomly generated images" kind of article, DevShed has posted their latest - Security Images with PHP and ImageMagick.
16648
Opt-out button in spam used to run exploit
238259
If you took the photo of a Chihuahua at   www.flickr.com/photos/benvoluto/216323527/, you have caused a   Web sensation.