I wrote a research paper on this topic just last month This issue is entirely preventable. The only reason we keep seeing this style of attack is because our industry keeps repeating the same mistakes over and over again 😔

Whoa this is stunning

✨Microsoft security✨

With the AWS outage, now‘s as good a time as any to post this old strip.

Working on Crypto in the #laravel world? Hit me up, I want to see what you're doing! I've got solana stablecoin p2p, offramps to banks and more going on over here 😍

Once upon a time, USBs and CDs could auto run. That’s how worms like stuxnet and Agent.BTZ spread everywhere We learned the hard way and killed autorun Now we `npm install` 1,000 different dependencies from the internet and consider it “safe”, forgetting that it does the exact same thing

Curious what it looks like to implement the new Inertia Infinite Scroll component? Have 3 minutes? That's all it takes. I whipped up a little demo: youtu.be/gQB6DdPHzSY

Is username enumeration (UE) a real vulnerability? Yes, and it matters more today than it did a few years ago. As phishing attacks look more legitimate, even smart people are getting tricked This week I saw a UE+phish lead to an account take over, and the URL in the Phish was a legitimate url

If there is one thing I've learned in the last year, it's never use a property named "type" I have lost so many hours debugging this exact bug but alas I am a goldfish just did it again, for the third time this week 😭

This would have saved me a few hours making some things GDPR compliant!

“Think like a hacker” is one of my favourite phrases It leads to the zero trust mindset. Assume a breach will happen and brainstorm what you can do to reduce that risk Short liven tokens are just one thing that can help. I encourage you to research OIDC tokens, it might just save you one day

I love a community that listens! Securing the supply chain is my current research topic and the more I learn, the more I find we can do

🚨 Warning to #PHP package maintainers: We did not email you to change your passwords & 2FA. Emails asking you to update your credentials are a phishing attempt. We had the phishing site & domain taken down. If you got the email and entered your credentials, please contact us. #phpc

Today I leaned about OIDC tokens and how you can use them to prevent GitHub actions from having access to long lived secrets (like AWS) While its not yet supported by my main provider, I can certainly clean up my AWS actions and hope others add it to their roadmap 🙏 docs.github.com/en/enterpris...

Today I learned about NPM Provenance, and how it helps prevent some supply chain attacks but it turns out its widely un-used and even some orgs don't use it yet (looking at you @laravel.com) If you run any NPM repo at all, you should look at implementing it! docs.npmjs.com/generating-p...

Best game I've played in a while, if you have an hour or so to loose

In the past month, I've noticed a huge decrease in quality of code produced by AI. Coincidentally in the past month, I've also seen a huge jump in external providers shipping broken features and updates 🤔

Another day, another supply chain attack. Stay safe out there www.bleepingcomputer.com/news/securit...

This week I solved a really hard coding problem which is going to save me about 2hrs a day. I initially thought it would be impossible, but ~100 lines of regex and ~50 if() statements has solved it! I’m going to be riding the high from this feat for a while 🥰

I wish I knew about this laravel helper function earlier 😍

I need a tool that lets me easily share code snippets, but also it’ll have auto ai conversions to other code languages, but you can step in and clean it up when it’s not quite right

My niece is an amazing young lady who loves helping others Her absent prick of a father tried to stop her volunteering with a special school over in Malaysia but she won in court! If you have some spare change, pls consider supporting her great work gofundme.com/f/klang-special-school-in-malaysia

Some of y'all still need to do this! I just found a site running the vulnerable version of livewire. Update now fools!

We just added a whole lot of new profiles to the Larabelles directory. 83 in total right now! 🎉 Go and learn about some of our incredible members. We all come from different paths of life, have different interests and stories, but together we are making the tech industry better. 💪

The feast was a success 🔥

Being fully WFH, I find it harder to socialise with my workmates. So today I’m inviting them over to my house for an American style bbq feast 🤤 Ribs, beans, mac n cheese, cornbread, coleslaw, veggie kebabs (w halloumi, cherry tom, capsicum, mushroom, red onion, zucchini)

Clickbait articles that never answer their own headline should be open to takedown requests on Google 😤

Do you ever repost something then totally forget about it? I find myself finding cool tips in my own timeline. Having worked with laravel for over a decade, I often forget the neat little helper functions that've been created along the way

What really grinds my gears is Saas products built for companies that will cut you off instantly when billing fails Please, I will give you the money, just give me one working day to fix it. Don’t make me login on a Sunday while I’m out with family to fix a work project 😫

🎥 Missed one of my past conference talks? Let’s fix that. I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs. “Security is Everybody’s Job” 📽️ https://twp.ai/9PUtHm #CyberSecurity #SecurityAwareness #appsec #devops #devsecops

Only 3 days left to apply for the BSides Canberra 2025 Assistance Program! If you’re based in Australia or NZ, over 18, and facing financial barriers to attending, now’s the time. Apply here: forms.gle/LtcXQE9Yv2rZ... Applications close 14 August.

My GPT 5 first impression is that this is a massive step backwards Completely unusable for anything I’ve thrown at it One simple array had 7 duplicates 🤦🏼‍♀️

This is your reminder to: `composer audit` and `npm audit` your projects Remember, most breaches come from known vulnerabilities. Save yourself a future headache <3

A critical NestJS vulnerability (CVE-2025-54782) allows remote code execution (RCE). Developers are strongly advised to update @nestjs/devtools-integration to v0.2.1 immediately. This attack is already mitigated by our existing BLOCK rule: Code Injection (3fe69f2a728e40dfabd2cfb602a9ee96)

Bookmarking this thread for later (bsky needs a real bookmark feature 😫)

If you attended Laracon US, you already know this, but: I'm currently wrapping up the last three videos of my upcoming course, which is all about how I built the incredible development team at @tighten.com. The course will be free (!!), hosted on Laracasts, and out this autumn!

I honestly never thought a SQL join with no user input could cause a security vuln, but I was wrong. Remember to use select statements my friends and stay safe

To all of those social butterflies in Denver - enjoy Laracon! Don’t forget to keep an eye out for someone seeming on the outer, someone needing to feel included, someone needing a smile. There are lots of invisible developers out there. Try to do something that can help others feel seen.

I’ve been seeing huge spikes in generative ai related fraud If it’s not effecting you yet, it will probably soon. Be prepared, start planning early, game plan areas it could impact you Assume that traditional tools like WAFs, captcha and KYC’ing are no longer safe bets

Today I tried getting GitHub's PR Copilot to work on an issue for missing page titles to see how it goes. Outcome: It did the thing but also re-installed storybook and created and added Storybook static files, all in one commit.

Thank you SO MUCH @johnsoncodehk.bsky.social for all your hard work. @vuejs.org devs, it's hard to overstate what Johnson has done to make our lives better. Everytime you ctrl + click a component, get auto complete for slots, see red squiggles for missing props, use defineProps or defineEmits etc

Timezone handling can be complex, but if you just need to display a time in the user's timezone, it can be relatively straightforward. Aaron was kind enough to write up his solution. masteringlaravel.io/daily/2025-0...

Bluesky is not twitter because we block losers before we even see their sad attention seeking. Think of it as vaccinating your account. Here’s an example: 1. Go to @skywatch.blue 2. Tap Lists and scroll down to MAGA 3. Tap subscribe & then block accounts. 4. All the magas now rot on the vine

If it looks like malware and smells like malware, it’s probably malware This makes me want to uninstall all of the meta apps

Got my ticket already 🤓

Just received my first PHP Pull Review from Github Copilot: > You could simplify this query removing the nested where statement... Auto commit suggestion? 🤦‍♀️ AI really is going to cause headaches and vulnerabilities for devs that don't understand the impact of their suggestions

CSS is growing up 🥹 Here is a article on it too css-tricks.com/if-css-gets-...

I have certainly noticed an increase in “AI slop” vulnerability reporting. Especially on new PRs. It feels like people are trying to “win” at something, but I’m just not sure what they’re aiming to do other than waste each others time arstechnica.com/gadgets/2025...

I have learnt a lot about mitigating fraud over the past couple of years Part of me want to do a talk or share my experience but I fear the second I share tips, the fraudsters will learn from it and get smarter 😅