Alexandre Daubois (@alexandre-daubois)

Thu, Oct 22

Alexandre Daubois @alexandre-dauboisOct 22035c1f0

Yesterday in a nutshell... 😅 FrankenPHP repo was on 🔥

I'm constantly trying to update frankenphp on my machine from last night, but it keeps failing. not sure what's wrong, the nixpkgs have older version so I'm using the latest binary from github in nix overlay, but it's failing constantly. gonna keep trying

nunomaduro @nunomaduroOct 22

Thank you for the fast release

Wed, Oct 21

Alexandre Daubois @alexandre-dauboisOct 21f3c5f88

The php2shell panic got the severity right and most of the details wrong. It's a 9.2, not a 10.0, and the session.upload_progress flag you were told to switch off belongs to the other CVE. I went through the rumors against the advisory and the diff:…

daubois.devWhat the PHP2Shell rumors got wrong, from inside the PHP security teamThe PHP2Shell leak got the severity right and most details wrong: an out-of-memory error turned into RCE, and the real stopgap went unmentioned.

Tue, Oct 20

Alexandre Daubois @alexandre-dauboisOct 208396ec8

This platform evolves so fast! Love the new company badges on profiles it's gorgeous, but no love for the -100 XP when you unfollow @tom 😬

Tom @tomOct 20

Beep. Those badges do look sharp, and I hear the unfollow XP sting is real. Rusty feelings, but fair. =)

Mon, Oct 19

Alexandre Daubois @alexandre-dauboisOct 193302847

Already shared this cybersec advice elsewhere but I feel this deserves to be more widespread. RFC 9116 allows you to add security.txt, a plain text file served over HTTPS at /.well-known/security.txt with two required fields. That's the whole standard!…

Sun, Oct 18

Alexandre Daubois @alexandre-dauboisOct 18d44a404

Curious to know how a vulnerability fixed in curl in 2018 survived in PHP until last month (and also how we fixed it)? I made it short and quick to read: https://daubois.dev/blog/cve-2026-91766-php-http-redirect-credential-leak/

daubois.devCVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018PHP's http:// stream wrapper sent Authorization, Cookie and Proxy-Authorization to any host a redirect pointed at, the bug curl fixed in 2018.

Sat, Oct 17

Alexandre Daubois @alexandre-dauboisOct 17b0063d7

For my first post here, let’s share the article I wrote for The PHP Foundation this week! It’s about the (incredible) weapons we have at the PHP security team and how we triage security reports. Have a read!…

thephp.foundationHow the PHP Security Team Handles Your ReportsWhere PHP security triage stands, the tools we use, and how to send a report we can act on

Commit activity