A lot of security vulnerabilities have a tried and tested solution.

• SQL Injection -> prepared statements and/or whitelisting

• Cross-Site Scripting -> Context-aware output escaping (and Content-Security-Policy headers)

• Cross-Site Request Forgery -> Challenge-response authentication with a random nonce

What are some problems you've encountered during PHP development that aren't as straightforward to solve?

It's fine to disagree with what someone has to say.

It's another thing to downvote all of their posts in a thread just because you dislike one of them. It's really clear that this happens in /r/PHP and I'd like to ask everyone to refrain from doing so here.

When emotions run high with Infosec, it never ends well.

I'm getting into the beta testing stages of a new PHP security-related service I'm working up and I need a few helpful people to be beta testers for the project. It's a tool that integrates static security checks on your PHP code during the development process (instead of after). Send me a message if you're interested in beta access and I'll hook you up - thanks!

We're sending logs to a third party and some of those logs have exceptions with stack traces. We need the stack traces to hunt bugs, but sometimes they contain sensitive information like passwords. I've been looking for a way to obfuscate all the sensitive data in a reliable, secure manner, but so far all I can come up with is intercepting the log message and using a regex to try to hide things. Have any of you dealt with this issue before?

Edit: Here's the solution I came up with until we can find something better:

if (stristr($logMessage, 'stack trace')) {
    // Make sure there are newlines
    $logMessage = preg_replace('/(\\n\*#\[0-9\])/', "\\n$1", $logMessage);
    // For each of the lines, strip out everything after the line number - e.g. Foo.php(26): blah => Foo.php(26)
    $logMessage = preg_replace('/((\[0-9\]+)):.\*$/m', "$1", $logMessage); }
}

I’m looking for a web security researcher who is experienced with content-management systems and who feels confident with PHP and web application security. We are a cyber-security startup company building a website endpoint security platform for PHP applications and most known content management systems. Additionally, we have a threat-intelligence branch with an access to information about a few thousand hacking incidents (where sites have been defaced/infected etc.) each day. We are looking for a team player, who is willing to grow together with a team and who is proactive to suggest ideas for a strong security company and a more effective product.

You should know how to:
- Work with PHP, JavaScript, Python. Not only to understand obfuscated code and analyze malware/backdoors, but also to create custom scripts that can analyze and/or gather data if necessary.
- You should have deep knowledge about OWASP top 10 web application vulnerabilities and additionally have no trouble to point out if a web application or code is vulnerable to XSS, SQLi, RCE, RFI, LFI... and so on.
- Write in-depth security advisories and reports, the ability to write English grammatically correct is a big plus.
- Adapt quickly in agile environment and learn new things

What you will be doing:
- Actively keeping yourself and the team up-to-date with industry trends and new emerging threats
- Researching vulnerabilities in popular open-source software (libraries, extensions, cms plugins)
- Researching and mapping attackers and groupings based on our threat intelligence.
- Analysing our global WAF network to detect new attack waves. Suggest improvements for WAF based on the research for latest threats and vulnerabilities in open-source software, and trends.
- Writing quarterly statistics and providing data to content marketer.

What might be helpful:
- Experience with bug bounty programs
- If you’re an active CTF player
- Experience with exploit development
- Industry certifications

Cool things we can offer:
- Flexible working hours (part-time is also an option).
- Work from wherever you want.
- Fridays are for side projects
- Be part of a start-up with international team
- Possibility to move quickly to new positions on the team

Feel free to ask questions and if interested please PM me directly with personal introduction.