This platform evolves so fast! Love the new company badges on profiles it's gorgeous, but no love for the -100 XP when you unfollow @tom 😬
Alexandre Daubois
11 commits
AD
Alexandre Daubois
@alexandre-daubois
CTO 
@coopTilleuls / Security Engineer 
@ThePHPF / 
@symfony & FrankenPHP Core Teams
- @coopTilleuls
- Lyon, France
- daubois.dev
- github.com/alexandre-daubois
- Sponsor on GitHub
- Joined October 2026
Commit activity
11 commits in the last 7 days
longest streak 4 dayscurrent 4
366 / 400 XP34 XP to maintainer
Today
Yesterday
Already shared this cybersec advice elsewhere but I feel this deserves to be more widespread.
RFC 9116 allows you to add security.txt, a plain text file served over HTTPS at /.well-known/security.txt with two required fields. That's the whole standard!…
Sun, Oct 18
Curious to know how a vulnerability fixed in curl in 2018 survived in PHP until last month (and also how we fixed it)?
I made it short and quick to read: https://daubois.dev/blog/cve-2026-91766-php-http-redirect-credential-leak/
daubois.devCVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018PHP's http:// stream wrapper sent Authorization, Cookie and Proxy-Authorization to any host a redirect pointed at, the bug curl fixed in 2018.
Sat, Oct 17
For my first post here, let’s share the article I wrote for The PHP Foundation this week! It’s about the (incredible) weapons we have at the PHP security team and how we triage security reports. Have a read!…
thephp.foundationHow the PHP Security Team Handles Your ReportsWhere PHP security triage stands, the tools we use, and how to send a report we can act on
That's @alexandre-daubois's root commit.