Stephen Rees-Carter (@valorin)

Today

I thought reading LOTR on stage at Laracon AU was the craziest thing I've done, turns out hacking into someone else's conference talk is even better. 😈

Pauline Vos @paulinevos7h

Hahahah I love the custom hacker lighting you requested. Although in my opinion it should have been a terminal green!

alesdevux @alesdevuxquoted9h

Fan of this

Punyapal Shah @MrPunyapal10h

🥵🥵

Tue, Nov 3

Stephen Rees-Carter @valorin1d98910d1

#LaraconAU is tomorrow! 😁

Mon, Nov 2

Stephen Rees-Carter @valorin3d7d848b3

Feels a bit weird to be getting off an international flight in Brisbane for Laracon. 🙃 Also, that humidity still hits hard.

David Ciulla @offskip-dave3d

Laughs in Japanese summer *cries inside*

Márk Magyar @xHeaven3d

I can withstand any kind of humidity, I hate this cold here so, so, so much. I'm staying inside until July istg.

Fri, Oct 30

Stephen Rees-Carter @valorin6d5b4fac2

I find it painful sometimes, sitting in a security conference where they talk about how insecure consumer devices and enterprise appliances are because of all the command-line RCEs on everything, and yet PHP is the insecure one? 🤦

Matthew Peck-Deloughry @mdeloughry6d

I have always thought that too, I think PHP is destined to never lose its >5.xx reputation, or even to developers the misconception that PHP and WordPress are the same technology. I’m not saying Wordpress is bad but it was just(is) super popular and was easily misconfigured!

Evan Edwards @EvanEdwards6d

I don't know if it is still standing, but about two days ago, the fellow who had a bitcoin in a webserver running unpatched PHP still had not been hacked. No reports of hacks have happened. I genuinely wonder if php2shell was a moral panic. Not the bugs and potential problem…

Sun, Oct 25

Stephen Rees-Carter @valorinOct 25719e664

Getting sqlmap to abuse a Livewire endpoint is a wonderful way to relax after a stressful week. 😈

Punyapal Shah @MrPunyapalOct 25

Was those locked property calls were from you 😂

Sat, Oct 24

Stephen Rees-Carter @valorinOct 24d5f6e4e

Flying to Wellington NZ in a few days for Kawaiicon. Should I rent a car for my exploring day, or just use public transport/walk?

Fri, Oct 23

Stephen Rees-Carter @valorinOct 235dd6132

Weird, my GH profile picture disappeared so I had to go upload it again. 🫤

David Ciulla @offskip-daveOct 23

Huh, I saw someone else mentioning the same issue earlier today. @nunomaduro @paulinevos @brendt @mnapoli

Thu, Oct 22

Stephen Rees-Carter @valorinOct 22dc6e194

Didn’t want to shill my stuff during the chaos or in my Security Notices, but now things have calmed down (I hope!): I do Laravel & PHP Security Audits & Pentests. If PHP2Shell has you wondering what’s hiding in your own apps, I can help. valorinsecurity.com

Stephen Rees-CarterLaravel Security Audits and Penetration Tests – Stephen Rees-CarterLooking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

Di @mechelonquotedOct 23

And he is one of the best. Go work with Stephen!

Stephen Rees-Carter @valorinOct 22c315bf0

As promised, here's my summary of the day, with a bunch of useful links to find out more: https://securinglaravel.com/security-notice-critical-php-security-release-the-day-after/

Securing LaravelLaravel Security Notice: Critical PHP Security Release - The Day After[Notice #6] The patches landed, the servers (just) survived, and the disclosure fell apart around them. Here’s the full round-up in one place - where to find the details, how to get patched, and the chaos that made a hard day harder.

Christoph Rumpel @christophrumpelquotedOct 22

Good read, thanks Stephen

Di @mechelonquotedOct 22

As always, a great read. Thank you!

Michael Dyrynda @michaeldyryndaquotedOct 22

Buckle up folks, Uncle Stephen has a story for us

Stephen Rees-Carter @valorinOct 22a67cf18

How'd we all go overnight? I'm catching up on everything that's happened since my last and will put together an article with all the details I can find that feels useful to have in one place. Let's agree to not do this again for a while, yeah?

Philip Joyner @filljoynerOct 22

We just wrapped the day. Stopgaps added 24hrs ago, shut down nonessential servers, rolled out more stopgaps while we waited for the patches to get compiled and mirrored then finally patching. Today was a long day after a long night. Hope you all went well with your infra…

Wed, Oct 21

Stephen Rees-Carter @valorinOct 21811cff8

Honestly, it's pretty disappointing to see responsible disclosure fail like this. It takes a lot of effort to release a critical patch. Leaking the announcement or publishing a PoC before a scheduled patch shows you have no ethics and are only interested in credit for yourself.

Alberto Arena @albertoarenaOct 21

It is also frustrating because I don't have control over the servers where my applications run. Until the patch is out, what can we do, apart from asking the providers?

Stephen Rees-Carter @valorinOct 218ffbf1e

Well today is not going the way I expected... yikes. 10 hours until patches drop.

Rachelle Wise @WiseArtsOct 21

Not sure if you saw this, might be helpful in some instances https://jackalsyn.com/posts/php-up-2026.html

jackalsyn.comOnly for the curious...

Stephen Rees-Carter @valorinOct 214e1abe3

Something tells me I'm not getting much sleep tonight. This drops at midnight for me. I'll try and keep Securing Laravel updated with any details I'm aware of: https://securinglaravel.com/laravel-security-notice-critical-php-security-release/

NANils Adermann@nadermanOct 20

The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wed, Oct 21st 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare to update. Earlier release…

Securing LaravelLaravel Security Notice: Critical PHP Security Release ⚠️[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.

Adam Hosker @ahoskerOct 21

Unlucky timing, but given that twitter has a lot of how out already in leaks and accidental disclosures, that time looks optimistic. Half tempted to turn the server off before I go to bed.

Mon, Oct 19

Stephen Rees-Carter @valorinOct 19379994e

Found a fun new way to (ab)use Chrome's "Copy as Curl" feature. 😈 🤐

ADAMAS @dev-adamasOct 19

ha ha 😂

Sat, Oct 17

Stephen Rees-Carter @valorinOct 1715d8372

w00t! Top 50! 😎

CICamille Islasse@camilleislasseOct 17

The most followed devs and how they’re connected

Stephen Rees-Carter @valorinOct 17f21e65d

Kinda miss the short post lengths, tbh. Less walls of text.

Stephen Rees-Carter @valorinOct 17ad110ca

For the musicals fans: I just saw Hadestown: The Musical - so good! Go see it if you get the chance!

Simon Hampel @simonhampelOct 17

My daughter played one of the Fates in her high school's production of Hadestown: Teen Edition which we saw multiple times and thoroughly enjoyed - the kids did a great job too! Looking forward to catching the movie version of the original stage show some time.