Injection
SQL, OS command and template injection wherever request data reaches a query, a shell or a rendering engine.
Technology Security
Harden the language behind most of the web.
PHP powers an enormous share of the web, which means its well-known failure modes are everywhere. The issues are not exotic — they are the same handful of patterns, repeated across a decade of code.
RuntimeEOL version tracking
InjectionSQL, command, template
SecretsIn code & config
VerifiedEvery finding
The PHP issues that keep recurring
The dangerous parts of PHP are predictable: user input reaching a database query or a shell, objects rebuilt from untrusted data, files included by name from a request, and cryptography that was hand-rolled instead of used. Add secrets committed to source and error pages that print stack traces, and you have the shape of most PHP incidents.
We look for these classes specifically — in the running application and, where you want the deeper answer, in the source. Findings are confirmed before they reach you and mapped to the exact file, endpoint or setting, so the report is a fix list rather than a lint dump.
Coverage
What we secure in a PHP environment
The failure modes that lead to real PHP compromise.
Insecure deserialization
Untrusted data passed to unserialize(), the classic route to PHP object-injection and remote code execution.
File inclusion and path traversal
Dynamic include/require and file handling driven by user input.
Weak cryptography and password storage
Outdated algorithms, hand-written encryption and password hashing that would not survive a leaked database.
Hardcoded secrets
API keys, database passwords and tokens in source, configuration and version-control history.
Verbose error and information disclosure
Stack traces, phpinfo and debug output exposed to visitors.
End-of-life runtimes
PHP versions past their security-support window, tracked against the official calendar.
Approach
How a PHP assessment runs
Application testing, with optional source review for the deeper answer.
-
01 · Map the application
Endpoints, inputs and the runtime version identified.
-
02 · Test the classes above
Active checks within agreed scope; optional static review of the source.
-
03 · Verify
Every candidate confirmed against the live target before it is reported.
-
04 · Report and harden
Fixes at file and endpoint level, plus a configuration baseline.
Deliverables
What you actually receive.
The report is the product. If it cannot be acted on by a developer and understood by a director, we have not finished.
Verified finding report
Each issue with the affected endpoint or file and the concrete fix.
Secrets exposure report
What is recoverable from code, config and history, in rotation order.
Runtime and dependency status
PHP version support and third-party component risk ranked by exploit probability.
Hardening baseline
php.ini and application settings that close the common PHP exposures.
How we work
Six steps, and no surprises.
The same engagement model applies to every piece of work we take on, so you always know what happens next.
01
Scope
A 30-minute call, then a written scope: what is in, what is out, what we need from you and what it costs. Nothing starts before you sign it.
02
Authorise
Rules of engagement, testing windows, escalation contacts and a signed authorisation. Out-of-hours windows where production cannot take the load.
03
Test
Automated coverage first, then manual testing where judgement is required. Critical findings are reported the day we confirm them, not at the end.
04
Report
One report a developer can act on and an executive can read, with evidence, reproduction steps, business impact and a fix for every finding.
05
Remediate
A walkthrough call with your engineers. We answer questions on the fix, not just the finding.
06
Retest
A free retest cycle to confirm the fixes hold, and a clean summary you can hand to a customer, auditor or board.
Questions
PHP Security — answered.
The questions clients actually ask during scoping. If yours is not here, ask it directly.
Do you need our source code?
Not for the application assessment — that runs against the live target. Source review is an option that finds the code paths testing cannot reach, and where it is used, the code does not have to leave your environment.
Which PHP frameworks do you cover?
The assessment is framework-aware — Laravel, Symfony, CodeIgniter, WordPress and plain PHP among them — but the dangerous patterns are the same across all of them; only the syntax changes.
Is running an old PHP version really a problem if the app works?
Yes. An end-of-life PHP release stops receiving security fixes, so any flaw found after that date stays open forever. "It still works" and "it is still safe" are different statements.
Can you check for secrets in our git history?
Yes. A credential removed from the current file is still in the history, and that is one of the first places an attacker looks. We report what is recoverable and the order to rotate it.
Next step
Get a written scope and a fixed price.
A 30-minute call, then a scope document with what is in, what is out and what it costs. No obligation, and no charge for the conversation.