Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting. securinglaravel.com/security-tip... #Laravel

Recently finished an audit for one of my oldest clients, this was #5! 🕵️ By far the most rewarding part of my job is working with the same clients each year, seeing their apps grow, and their commitment to security strengthen. It's not just a compliance checkbox, it's part of their culture.

Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷 securinglaravel.com/security-tip... #Laravel

Things Claude says... > Is that concerning? For local files it's not a vuln — it's theater > Is it TOFU? No — weaker than TOFU Ouch.

Nobody cares about security until they suddenly care about nothing else... A breach, a near miss, an awkward client question, and it's suddenly top priority! Get ahead. I do Laravel Security Audits & Pentests, ideally on a quiet day, not the worst one. 🕵️ valorinsecurity.com

We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking, the attack behind tj-actions and Laravel-Lang. 😈 securinglaravel.com/in-depth-ver... #Laravel

If you've been shipping AI-written Laravel code lately (and let's be honest, you probably have), it's worth getting a human to actually read it! Reach out for an Audit/Pentest for the parts of your codebase that vibed a little too hard. 🕵️ valorinsecurity.com

I've got some capacity opening up over the next few months, so If you've been meaning to get a security audit / pentest done on your Laravel app - now is the time! 🕵️ 👉 DM or valorinsecurity.com

With Supply Chain Attacks, you often don't realise you've been compromised until it's already too late. And yet Canary Tokens - exactly the early warning you want - are hardly mentioned. They let you know the moment someone's sniffing around. securinglaravel.com/security-tip...

I may have gone to Japan and spent more time looking for these than sightseeing... maybe... (Technically I went sightseeing while looking for these, so it counts as sightseeing time, right?)

📦 Composer 2.10 is out. Native malware filtering via @aikidosecurity.bsky.social (enabled by default on Packagist), a unified config.policy framework for advisories/abandoned/malware, and source fallback now deprecated. blog.packagist.com/composer-2-1... #php #phpc #composerphp

It's apt then that in my inbox today is a email from @valorin.bsky.social with his latest security tip - securinglaravel.com/security-tip... and then the release of Laravel Moat by @nunomaduro.com - laravel.com/blog/moat-a-...

Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them. github.com/laravel/moat securinglaravel.com/security-tip... #Laravel

I love Signed URLs, but there is one very subtle trap you can accidentally fall into... securinglaravel.com/security-tip... #Laravel

Livewire's Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈 securinglaravel.com/in-depth-don... #Laravel

On the Securing Laravel blog, @valorin.bsky.social explores Laravel security concepts & techniques 🔐 - madewithlaravel.com/securing-lar...

Again, if you have a Substack, the best time to switch away was months ago -- but today's the second best time.

Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data? securinglaravel.com/security-tip... #Laravel

As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱 ❌ Bug fixes (they stopped 6 months ago) ❌ Security fixes (they stop today!) Have you upgraded yet? laravel.com/docs/release... #Laravel

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access. securinglaravel.com/security-tip... #Laravel

Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error. securinglaravel.com/security-tip... #Laravel

PSA for @statamic.com folks - update your sites ASAP! ⚠️ A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱 All the details: cvereports.com/reports/CVE-...

I am determined to get back to @laravellive.dk this year, so if you have a dev team or a meetup in EU or UK and want me to run a workshop or give a talk in August, let me know!

You can't trust an email address you haven't verified, so why are you storing them in your database? securinglaravel.com/in-depth-ema... #Laravel

routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one? securinglaravel.com/security-tip...

I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again... securinglaravel.com/security-tip...

It's been 4 months, a lot has happened, but I'm finally back to writing securinglaravel.com! New Security Tip coming out in a few hours...

Exhausted after #LaraconAU last week, but excited by how it all went! I was so proud of everyone in my workshop on Wednesday - everyone had a go, and the excitement in the room as they hacked through challenges made it all worth it.

Haven't bought tickets to my [email protected] Security Workshop yet?! 😲 I'll be locking in numbers early next week, so get your ticket TODAY or reach out to me directly. ⌛ This is your final warning... ⏰ events.humanitix.com/lets-hack-pr...

"Let's Hack!", my Pre-Laracon Security Workshop is just FIVE weeks away! 🎉 (So is @laracon.au... but let's be honest, priorities.) Only 11 tickets left, & I need to confirm numbers with the venue, so if you've been thinking about it, now's the time! 👉 events.humanitix.com/lets-hack-pr...

If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands? 🤔 securinglaravel.com/security-tip... #Laravel

Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does? securinglaravel.com/security-tip... #Laravel

We'll never know how @valorin.bsky.social keeps getting invited back to speak at @laracon.au but we do know that he always puts on a heck of a talk when he does! Learn how to defend your Hornburg on November 13-14! Grab your ticket before 29 Sept to get a 👕 in your size 👉 laracon.au/tickets

Security advocate and friendly hacker @valorin.bsky.social keeps finding his way back into the #LaraconAU lineup. Join us on November 13-14 for some practical security tips to help you defend your Hornburg (with or without Gandalf)

Laravel Security Tip: Do You Have a Permissions Policy? What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them? securinglaravel.com/security-tip... #Laravel

Do you reset your 2FA secret keys when a user toggles TOTP off/on? It's not just passwords you need to worry about when it comes to authentication and stolen credentials: if an attacker can steal a 2FA secret key, they'll always have a valid TOTP! 😱 securinglaravel.com/security-tip... #Laravel

It's important to be paranoid when it comes to production environments - because if you forget you're logged into prod, you may end up dropping a database... or worse! 😱 Laravel's new Prohibitable trait lets you disable Artisan Commands to avoid this! securinglaravel.com/security-tip... #Laravel

You may have heard of the /.well-known/ path, and the security.txt file, but there is a new one you should be aware of too: /.well-known/change-password It should redirect to your change password form, so password managers can easily send users there. securinglaravel.com/security-tip... #Laravel

Content Security Policies are awesome, but if you haven't fully configured all of your directives, it's possible to redirect requests, inherit Nonces, and get juicy CSP-bypassing XSS! 😈 securinglaravel.com/security-tip... #Laravel

Sometimes when I sit down to write a Security Tip it comes together so quickly that I'm surprised I hadn't written it sooner. 🤓 The one I'm about to publish came together perfectly, including the demo, and it has the bonus of being pure nightmare fuel. Win-win for me! 😈

So what you're saying is, you've all been off on a long weekend?

Ugh, I hate it when apps switch from Next/Previous Tab switching to Most Recently Used (MRU) switching with Ctrl+Tab! MRU is only logical when you can't see the other tabs, otherwise it's a UX disconnect between display and keyboard. 😒 Looking at you Telegram! 😡

We talk a lot about protecting password reset and login forms, but don't forget about the humble registration form, it can provide attackers with crucial intel! 😈 securinglaravel.com/security-tip... #Laravel

HTTPS is everywhere & easy, but HTTP is still the default option browsers will attempt when given a raw domain. How do you stop an attacker from abusing this by hijacking the initial HTTP connection attempt? 😱 This is where HSTS comes in... 🔒 securinglaravel.com/security-tip... #Laravel

Technically, XSS involves injecting malicious Javascript, but sometimes you don't need any JS to get up to mischief! 😈 securinglaravel.com/security-tip... #Laravel

Do you know what information is being leaked by the Referer header when your users click on external links? If you site is public, you might be safe - but what if you have internal apps, or sensitive information in your URLs? securinglaravel.com/security-tip... #Laravel #PHP

As useful as it sounds, nl2br() can potentially leave you open to Cross-Site Scripting (XSS) vulnerabilities... you should reach for CSS instead! securinglaravel.com/security-tip... #Laravel

🚨 The #LaraconAU talk titles are live! 🚨 👉 laracon.au/schedule We’ll reveal who’s speaking on what next month - but for now… can you guess? 👀 Submit your guesses and you could win a premium hoodie 🐘💚

Over the years, Stephen's security insights have transformed how I build applications. Not only are they more secure, but I have genuine peace of mind knowing I'm avoiding critical vulnerabilities. If you have 5 minutes to spare, dive into Stephen's content - you won't regret it. 👀

Friendly reminder: Laravel 11 stops receiving bug fixes on Wednesday! 😱 This means you've only got 6 months to upgrade to 12 before security fixes are ended too. Don't put it off or you'll find yourself with an unsupported version before you realise it! ⌛