Security

A sealed shipping box is handed across a counter, along with a clipboard holding a form. A packing note listing the enclosed items with quantities and prices is affixed to the box. A visual metaphor for a bill of materials that is created while packing and ships with the package instead of being guessed at afterwards.

August 5, 2026

Your composer.lock knows what a carmaker only guesses

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring. Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents.

A hand presses the red emergency stop button of an industrial machine. A visual metaphor for a switch that halts the execution of code: exactly what zend.disable_eval does for eval().

July 29, 2026

When static analysis runs your code

A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool. Why disable_functions cannot reach eval(), and what a switch in the PHP engine to disable it could look like.

A heavy steel chain lies on a dark surface. Where a link is missing, a thin knotted orange rope ties the two ends together. A visual metaphor for a supply chain whose strength is decided by its weakest link.

July 15, 2026

Composer and Packagist under supply chain stress

2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems. A review of Composer and Packagist: what PHP does well, what it can learn — and who owns our infrastructure.

A mechanical stopwatch lies on a weathered wooden surface, waiting to be started. It symbolises how the duration of a test run has become a measurable factor that determines more than just developer convenience.

June 12, 2026

Speed as a security feature

How fast is your test suite, and what vulnerabilities does an LLM agent therefore fail to detect? What was long considered a productivity issue is now part of the security debate.

A young man in jeans and a white long-sleeved shirt, rendered in black and white, swings a large green shield emblazoned with a bright red checkmark, batting away a flurry of crumpled paper balls against a soft peach background – a metaphor for using tests as an active defence that knocks out security weaknesses before they can reach production.

June 10, 2026

Test-Driven Security

For every vulnerability we find in production, there is a test that, had it existed, would have prevented it. Test-Driven Security treats the CWE list as a checklist and PHPUnit as the tool we already have in our workflow.

Only what must exist has a door. The safest door is the one that was never built.

May 20, 2026

The attack surface begins in the repository

We protect what exists. But do we ask often enough whether it should exist at all? How removing unused branches can protect against Poisoned Pipeline Execution.

A heavy steel chain breaks at its central link in a burst of red-orange sparks, with fragments of binary digits scattering outward against a deep blue, circuit-lit background. A visual metaphor for the supply-chain security failure that workflow hardening is meant to prevent.

May 17, 2026

Hardening GitHub Actions workflows

A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.

A bouncer in a black suit, earpiece in, hand raised in a firm "stop" gesture at the door of a club. Behind him, a queue of hopeful guests waits behind a golden velvet rope. A visual metaphor for a gatekeeper deciding who gets in and who does not.

April 18, 2026

The Bouncer in the Dependency Resolver

Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself. This article walks through how the mechanism works, how it relates to the older packages it replaces, and where it can bite you.

The image shows an abstract, futuristic design with a dominant, glowing question mark as its central motif. It emerges from a chaotic, undulating landscape of geometric pixels and voxel-like structures in intense shades of pink, purple and blue. These create depth and dynamism. The chaotic background resembles a seething, digital terrain that symbolises disorder and complexity. The question mark rises stably and questioningly from it – perfect as a visual mood for fuzz testing, where random chaos reveals security.

April 8, 2026

Security through chaos

This practical deep dive into the philosophy behind "security through chaos" shows that security does not come from perfect foresight, but from surviving chaos.