Websec.io (@Websecio) header
Websec.io (@Websecio) profile picture

Websec.io

@Websecio

websec.io is dedicated to educating developers about web application security principles and practices. We believe an informed developer is a secure developer.

websec.io
Joined February 2013
  • Tweets605
  • Following0
  • Followers161
Whether you need a PHP secure code review, application security training or an architecture security assessment, we can help! Check out our consulting services for more information: websec.io/consulting
1
2
Websec.io retweeted
ITNEXT (@ITNEXT_io) profile picture
ITNEXT@ITNEXT_io3 Dec 2020
How to implement password recovery securely in PHP by Nicolas Far at #ITNEXT. #Php #Security #PasswordSecurity itnext.io/how-to-implement-p…
2
5
Hey everybody, I grew up! 😁 Version 4.2 of the Web Security Testing Guide is now available! 👇 owasp.org/www-project-web-se…
8
188
34
488
Drupal core - Critical - Remote code execution - SA-CORE-2020-012 ow.ly/fugr50Cofms

Drupal core - Critical - Remote code execution - SA-CORE-2020-012

drupal.org
3
72
11
94
From the Psalm blog (a PHP static analysis tool from @Vimeo): “Detect PHP security vulnerabilities with Psalm” psalm.dev/articles/detect-se…

Detect PHP security vulnerabilities with Psalm

Security vulnerabilities are often pretty hard to spot manually. While a null-pointer error can make itself known very quickly, you can execute code…

psalm.dev
1
4
1
12
“Perforce Unveils New PHP Security Center by Zend“ realwire.com/releases/Perfor…
4
7
Websec.io retweeted
Laravel (@laravel) profile picture
Laravel
@laravel13 Mar 2020
🚨Security: Laravel 7.1.2 has been released to address a possible XSS attack vector in Laravel 7.x Blade components: blog.laravel.com/security-la…
Security: Laravel 7.1.2 Released | Laravel - The clean stack for Artisans and agents

Security: Laravel 7.1.2 Released | Laravel - The clean stack for Artisans and agents

Today we released Laravel 7.1.2 to address a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dict...

laravel.com
4
80
4
190
Securing Credentials for PHP with Docker: Keeping secrets secure with cutting edge technology doesn't have to be...: fdlr.io/bvq
1
Laravel Daily: “Laravel Auth: After-Registration Redirect to Previous (Intended) Page” laraveldaily.com/auth-after-…
Laravel Auth: After-Registration Redirect to Previous (Intended) Page

Laravel Auth: After-Registration Redirect to Previous (Intended) Page

laraveldaily.com
3
2
Symfony Blog: “New in Symfony 4.3: Native password encoder” symfony.com/blog/new-in-symf…
New in Symfony 4.3: Native password encoder (Symfony Blog)

New in Symfony 4.3: Native password encoder (Symfony Blog)

Symfony 4.3 introduces a new native password encoder to auto-select the best possible hashing algorithm available to hash user passwords.

symfony.com
9
6
We just finished up the second part of our "OWASP Top 10 for PHP" interactive training sessions to our offerings, this time covering authentication issues - check it out! training.websec.io
3
4
From the Symfony Blog: “New in Symfony 4.3: Sodium password encoder” symfony.com/blog/new-in-symf… #libsodium #password
New in Symfony 4.3: Sodium password encoder (Symfony Blog)

New in Symfony 4.3: Sodium password encoder (Symfony Blog)

In Symfony 4.3 we've replaced the Argon2iPasswordEncoder by a new generic SodiumPasswordEncoder that supports all the Argon2 variants (argon2d, argon2i, and argon2id)

symfony.com
2
4
⚠️ If you're using laravel-query-builder, stop what you're doing and update to the latest version now. ⚠️ All older versions allow SQL injection attacks. Here's some background on the issue: murze.be/an-important-securi… #laravel #php #security
12
150
5
244
Zend Framework Security Advisory: “ZF2019-01: Information disclosure in zend-developer-tools” framework.zend.com/security/…
3
1
From @thehackersnews: “WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites” thehackernews.com/2019/04/wo… #wordpress #security #ios
WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites

WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites

WordPress iOS App Bug Leaked Users' Secret Access Tokens to Third-Party Sites

thehackernews.com
1
6
6
WPScan 3.5.0 released! github.com/wpscanteam/wpscan… "gem update wpscan"

Release v3.5.0 · wpscanteam/wpscan

Changes/Improvements: All enumeration processes, and most other checks now use HEAD requests and then perform a GET when suitable (related to the long wanted #211). This reduces the data received,...

github.com
13
1
19
Websec.io retweeted
WordPress (@WordPress) profile picture
WordPress
@WordPress1 Apr 2019
Minimum PHP Version Update. Update PHP Today, so you can update WordPress tomorrow. wordpress.org/news/2019/04/m…
Image from WordPress (@WordPress)
13
152
46
192
Websec.io retweeted
Dug Song (@dugsong) profile picture
Dug Song@dugsong5 Mar 2019
#WebAuthn is now an official web standard for password-less logins! w3.org/2019/03/pressrelease-… See webauthn.guide for context and webauthn.io for code, and thanks to @yubico & @duo_labs for supporting open standards and open source!
Image from Dug Song (@dugsong)
Image from Dug Song (@dugsong)
1
28
2
65
From @colloq_io: “Password Rehashing in PHP” colloq.io/blog/password-reha…
3
9
Benjamin’s Blog: “Intro to basic web application security” raeder.technology/post/intro…
1
5
1
14
Load more