PHP security guides
PHP security guides
Beyond PHP2Shell, most PHP compromises come from a handful of well-known bug classes in application code. These guides explain each one in plain language, how to find it in your own code and how to fix it.
Last updated
Common PHP vulnerability classes
- PHP object injection: what it is and how to fix itPHP object injection happens when user-controlled input reaches unserialize(), which can instantiate objects whose magic methods run attacker-chosen logic.
- PHP file inclusion (LFI/RFI): what it is and how to fix itFile inclusion happens when user input controls the path passed to include or require, letting an attacker read local files (LFI) or, with allow_url_include on, run remote code (RFI).
- SSRF in PHP: what it is and how to fix itServer-side request forgery (SSRF) happens when a PHP app fetches a URL the user controls, letting an attacker reach internal services or cloud metadata endpoints through your server.
- XSS in PHP: what it is and how to prevent itCross-site scripting (XSS) happens when a PHP page outputs user-controlled data into HTML without escaping, so an attacker’s script runs in other visitors’ browsers.
- phpinfo() exposure: why it matters and how to fix itA public phpinfo() page reveals the exact PHP version, loaded modules, file paths and often environment variables or secrets, which helps attackers target bugs such as PHP2Shell.
Versions, distributions and related advisories
- Is my PHP version still safe?Support and PHP2Shell status for PHP 7.4 to 8.5.
- PHP2Shell fixes by distributionFixed package versions for Debian, Ubuntu, RHEL, SUSE, Alpine and Amazon Linux.
- Magento SessionReaperCVE-2025-54236 in Adobe Commerce and Magento: affected versions and hotfix.
- Related security incidentseMudhra CA keys, CMS webshells, Packagist supply chain, OpenSSL.
Sources
Outbound links leave this site. We do not host exploit code.
- Cross Site Scripting Prevention Cheat Sheet — OWASP Cheat Sheet Series
- Server-Side Request Forgery Prevention Cheat Sheet — OWASP Cheat Sheet Series
- Supported Versions — PHP project (php.net)
- Security update available for Adobe Commerce | APSB25-88 — Adobe