Open Source PHP Static Code Analysis
La Haye, Pays-Bas
Joined April 2014
- Tweets3.2K
- Following149
- Followers1.2K
- Likes1.7K
exakat, static analysis for PHP retweeted
@mitchellh another one for your OSC7501 list: Composer package manager for PHP 😃
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
exakat, static analysis for PHP retweeted
Everyone called php2shell the next Log4Shell. It wasn't, and the reason is in the offsets: every exploit chain is pinned to one exact build, so the public PoCs mostly crash on a different one.
I reproduced it end to end. How many of the "actively exploited" reports do you figure were real shells, not mass scanning?
ilia.ws/blog/php2shell-two-w…
🤖 Made with AI
Here is a classic situation, where injecting an array of arrays leads to the infamous list of 'Array, Array, Array...'
What #PHP tool do you use to guard against this warning?
is_array() is not sufficient, and the type is already there.
There is nothing native available.
exakat, static analysis for PHP retweeted
The #php2shell panic got the severity right and most of the details wrong. It's a 9.2, not a 10.0, and the session.upload_progress flag you were told to switch off belongs to the other CVE. I went through the rumors against the advisory and the diff: daubois.dev/blog/cve-2026-10…
exakat, static analysis for PHP retweeted
Bref runtimes and container images with the patched PHP are out.
(31 minutes after php released 💪)
github.com/brefphp/aws-lambd…
to update:
- composer update bref/bref && redeploy
- Docker: pull bref/php-xx-fpm again
PHP-FPM is the affected runtime, Octane / function runtime are not in the attack paths. Update everything anyway.
CVE details: php.net/archive/2026.php#202…
I updated my #PHP versions on Debian and OSX.
Thanks for the fix PHP.
How's the update going with you all?
exakat, static analysis for PHP retweeted
📣 Announcing the immediate availability of #PHP 8.2.35
‼️ This address the following critical security issues:
- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)
📝 php.net/archive/2026.php#202…
exakat, static analysis for PHP retweeted
PIE 1.5 has been released, with new installation and upgrading features to make your life easier. 💙🥧 thephp.foundation/blog/2026/…
#php #pie #pecl
ALT A photograph of a berry flavored pie with raspberries and blueberries for garnishes. Photo by Tuğçe Ertaş Al on Unsplash.
exakat, static analysis for PHP retweeted
🚨 Pro Tip:
When using any third party libraries as your main services in your application, create a layer that should interact with that service, instead of directly accessing the service.
It becomes easier to switch the vendor package later on, when needed.
exakat, static analysis for PHP retweeted
Sponsorship packages for PHPBenelux Conference 2027 are open. Platinum, Gold, Silver and custom options. As a non-profit, sponsor revenue goes directly back into the Benelux PHP community. Get in touch to secure your spot before the expo hall fills up.
#phpbenelux #phpbnl27 #php
exakat, static analysis for PHP retweeted
🚀 Introducing PHPenomenal!
@faguo and I have been cooking up a challenge for PHP 8.6:
Build something cool using features coming in PHP 8.6. Surprise us. Get creative. Have fun with it.
Oh, and there’s a prize for our favourite!
Rules & repo:
github.com/dseguy/phpenomena…
GLHF 🚀
exakat, static analysis for PHP retweeted
PHP has been a server language for three decades. JavaScript is hitting the same problems now, and everyone is solving them their own way, with no standards landing.
#PHP #JavaScript #Bun
So, int cannot be part of a intersection type, nor can string, both being scalar.
Yet, there is a notion of numeric string, in #PHP, where this structure could fit. It would be a int (hence, a string), or a string that can convert to int.
What do you think?
ALT <?php function foo() : int&string { return '10'; }
#PHP lazy class constant is the default behavior when creating constant with expressions, rather than literal values.
This is both clever and a hidden trap. So, let's review that!
👇
ALT A lazy sleeping cat