Security
4 posts · authentication, captcha, limits
-
Security 4 min read
PHP2Shell: two critical flaws fixed in PHP 8.4.27
On October 21, 2026 PHP fixed two flaws rated CVSS 9.2 that allow code execution without login. What happened and how to check you are patched.
-
Security 4 min read
One attestation, one submit: back to the roots
Local jti replay protection via Cache::add worked. But server-side verify keeps single use with the authority, not with the integrator. Why I dropped that model.
-
Security 6 min read
Why Fortify verifies the captcha twice in one request
It is not a double form submit. With 2FA enabled, Fortify calls the authenticateUsing callback twice in one request and a single-use captcha token cannot survive that.
-
Security 8 min read
Laravel RateLimiter and a race condition
Why tooManyAttempts() + hit() in Laravel fails against 100 parallel requests - and how to fix it.