php-security
Safeguard articles tagged "php-security" — guides, analysis, and best practices for software supply chain and application security.
28 articles
Laravel Security Best Practices: Mass Assignment, Blade, and Debug Mode
Laravel's defaults are solid, but $guarded misuse, {!! !!} in Blade, and APP_DEBUG=true in production have all led to real compromises. Here's the fix.
XXE Prevention in PHP with libxml_disable_entity_loader
libxml_disable_entity_loader() looked like the fix for XXE in PHP, but PHP 8.0 deprecated it. Here's what it did, why it broke, and what to use now.
Secure Random Number Generation in PHP with random_bytes
PHP's mt_rand() has a 32-bit seed space attackers can crack in seconds. Here's why random_bytes() and random_int() replaced it in PHP 7.0, and how weak randomness still causes breaches.
Laravel Lang supply chain advisory
A leaked PAT let attackers rewrite 700+ git tags across four Laravel-Lang packages, planting a credential stealer that ran on every PHP request.
Security in PHP: Framework-Level Protections and Common Gaps
Security in PHP improved enormously once frameworks took over escaping, CSRF, and query building. The remaining incidents live in the gaps where developers step outside those rails.
PHP Code Checker Tools: How to Catch Bugs and Security Flaws in PHP
A PHP code checker can mean a syntax linter, a static analyzer like PHPStan, or a security taint scanner. Here is what each one catches and how to combine them.
PHP security best practices guide
A practical PHP security best practices guide covering SQL injection, deserialization RCE, upload hardening, dependency risk, and real exploited CVEs like CVE-2024-4577.
Securing Laravel PHP applications
CVE-2021-3129, leaked APP_KEYs, and Eloquent mass assignment still compromise Laravel apps in 2026 — here's how each attack works and how to close it.
PHP Code Analysis: Finding Security Bugs in PHP
How PHP code analysis works, which static and dynamic tools to use, and the PHP-specific vulnerability patterns worth hunting for in your codebase.
PHP Code Check: A Security Guide
A PHP code check should catch injection, unsafe deserialization, and vulnerable Composer packages before they ship. Here is a layered approach that fits a normal PHP workflow.
PHP Code Analyzer Tools: A Security Guide
A PHP code analyzer inspects your source without running it to catch security flaws, type errors, and bad patterns. Here's how static analysis fits a secure PHP workflow and which tools matter.
Docker Laravel Security: Hardening Your PHP Container from Base Image to Runtime
A security-focused guide to running Laravel in Docker — non-root PHP-FPM, multi-stage builds, secret handling, and locking down the layers that leak.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.