Scary stuff.
US BlackHat 2018 proved that is possible to obtain RCE from a PHAR package, moreover, by tweaking its binary content, it's possible to disguise it as a full valid image, bypassing security checks.
Read more [www.nc-lp.com]
Join 9,500+ smart developers
Get my monthly newsletter with what I learn from running Spatie, building Oh Dear, and maintaining 300+ open source packages. Practical takes on Laravel, PHP, and AI that you can actually use.
"Freek publishes a super resourceful and practical newsletter. A must for anyone in the Laravel space"
No spam. Unsubscribe anytime. You can also follow me on X.
Found something interesting to share? Submit a link to the community section.