The Clock That Cracks Passwords To understand what is the clock that cracks passwords, let’s start with a quizz. Which security flaw does the following PHP login check contains? If you said “the password should be hashed with bcrypt”, you are right and you may stay. If you said “use === instead”, you are wrong […]
30
Aug
Aug
Blocking PHP Reverse Shells: A Config-First Guide Every PHP reverse shell floating around GitHub, pentestmonkey’s original and the forty-seven forks that added a banner and changed the default port, does the same three things. It opens an outbound socket, it spawns a shell, and it detaches from the request so it doesn’t get murdered by […]
29
Aug
Aug
TypePHP, native PHP, NativePHP: the ecosystem has a vocabulary problem PHP names things by accretion. A word gets used for something, then reused for something adjacent, then reused again by a project that picked the name because it was available on Packagist. Nobody arbitrates. Ten years later you have a conference hallway conversation where two […]
28
Aug
Aug
Recently updated PIE extensions #4 (since August 21st, 2026) 25 PHP Pie extensions were updated. hmennen90/php-steamworks (v0.15.0): PHP extension providing access to the Valve Steamworks SDK via a flat C API symfony/deepclone (v0.8.3): Export any serializable PHP values as pure arrays – accelerator for Symfony’s DeepCloner php-debugger/php-debugger (0.3.0): A lightweight, high-performance PHP debugger extension. Comptible […]
28
Aug
Aug
What 3052 composer.json files tell us about the Composer plugin ecosystem I like to read composer.json files the way other people read tea leaves. Take enough of them and patterns emerge: which packages everyone depends on, which ones are stuck two major versions behind, and what a minimum-stability field says about a maintainer’s risk tolerance. […]
26
Aug
Aug
The Path Not Taken: everything that can go wrong with a path A path is a string. And, just like concatenation, this is the source of all our troubles. PHP treats it as a string, the filesystem treats it as a sequence of bytes with opinions, and Windows treats it as a suggestion. Somewhere in […]
24
Aug
Aug
Rewritten in PHP The application was “rewritten in Rust” meme runs one direction. Or it also goes to Go, just because it is fun. Here’s the traffic going the other way, and why it’s less silly than it sounds. Nobody writes a blog post titled “we ported it to PHP”. The genre convention is the […]
20
Aug
Aug
Recently updated PIE extensions (since August 13th, 2026) 25 PHP Pie extensions were updated. bsn4/grpc (v0.4.0): Rust-based gRPC extension for PHP — drop-in replacement for ext-grpc paragonie/ext-pqcrypto (v0.3.2): PHP extension for post-quantum cryptography (ML-KEM, X-Wing, ML-DSA, SLH-DSA) mongodb/mongodb-extension (2.4.0): MongoDB driver extension phalcon/cphalcon (v5.19.0): Phalcon is an open source web framework delivered as a C […]
19
Aug
Aug
The Secret Life of “Magic Null” in PHP PHP 8 has started a tightening in native functions arguments: every version brings stricter checks on calls to common functions. Gone are the days of passing null into a function expecting an integer and hoping for the best. Today, usort($arr, null) or array_walk($arr, null) will instantly crash […]
18
Aug
Aug
PHP Method Resolution Order: Class · Trait · Parent · Interface PHP offers three different places to define a method: directly in a class, in a trait the class uses, and in a parent class it extends. Interfaces define contracts, the method signatures without a body, so they don’t contribute an implementation to the chain, […]
14
Aug
Aug
Recently updated PIE extensions (since 7th, 2026) 24 PHP Pie extensions were updated. bsn4/grpc (v0.3.0): Rust-based gRPC extension for PHP — drop-in replacement for ext-grpc flow-php/flow-php-ext (0.43.0): Flow PHP native extension (Rust) – Floe frame-body encoder/decoder for DataFrame Rows xberg-io/tree-sitter-language-pack (v1.15.0): Pre-compiled tree-sitter grammars for 371 programming languages thomas-0816/pdo-duckdb-php (1.5.5.7): PHP PDO Driver for DuckDB, […]