php
Safeguard articles tagged "php" — guides, analysis, and best practices for software supply chain and application security.
19 articles
What Is a PHP Security Scanner and Which One Should You Use?
A PHP security scanner inspects your code and dependencies for injection flaws, insecure configuration, and known CVEs. Here is how the different tool classes work and where each fits.
Composer/PHP Supply Chain Threats: 2025 Report
A senior engineer's 2025 report on Composer and Packagist supply chain threats: namespace abuse, abandoned maintainers, plugin hooks, and the attacks that actually landed on PHP shops.
CVE-2022-31630: The PHP GD imageloadfont() Out-of-Bounds Read Explained
CVE-2022-31630 is an out-of-bounds read in PHP's GD extension triggered through imageloadfont(). Here are the affected versions, real impact, and the fix.
Composer/PHP Package Supply Chain in 2026
PHP's Composer and Packagist ecosystem has quietly improved its supply chain story. Here is where things actually stand in 2026, and what PHP shops should do now.
PHP Composer Security: Lockfiles, Packagist and Abandoned Packages
composer.lock is your integrity anchor, Packagist is a single point of trust, and roughly one in ten packages you depend on is quietly unmaintained. A field guide.
CVE-2024-4577 PHP CGI Argument Injection Explained
CVE-2024-4577 is a CVSS 9.8 argument injection in PHP-CGI on Windows that bypasses CVE-2012-1823's fix. Root cause, exploitation, and remediation.
PHP Composer Dependency Security
Securing PHP applications through Composer lockfiles, Packagist verification, and automated vulnerability scanning.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.