Any views expressed within media held on this service are those of the contributors, should not be taken as approved or endorsed by the University, and do not necessarily reflect the views of the University in respect of any particular issue.

PHPcon Poland 2019


I have attended the PHPcon Poland 2019 conference in Szczyrk. This is sa mall but beautiful surrounded by mountains. The scenery was perfect.

The conference had a lot of good presentations but I selected those:

  • Strict programming in PHP
  • How your PHP application can get hacked, and how to prevent that from happening?
  • Event Sourcing with PROOPH
  • 6 Things I Learned as a Lead Developer
  • git log: 10 most useful commands to learn everything about a project
  • Twelve principles for building high-availability systems
  • Agile clean architecture
  • Adventures in MySQL – 10 Awesome features you’re probably not using
  • Making architecture explicit

I couldn’t attend other talks that I was interested in and that is my only complain to the organisers where they put technical talks at the same time to be followed by two not very technical talks. That should be split so those who were only interested in tech stuff could attend more talks.

While all the talks were good and interesting there was one which was outstanding and I will focus on it only.

It was a presentation by Antti Rössi: “How your PHP application can get hacked, and how to prevent that from happening?”.

It was an eye opener for me. Antti one day was surprised that most of the software houses don’t have a separate position for a software security officer. Developers themselves maintain the security of their code. That is a problem because it is really hard to follow both software security and code development in IT.

The main message from the talk was that developer have learn how to think as hackers. And hackers only think how to brak your application in the way you didn’t even imagine.

Disclaimer: this is for educational use only.

One of the examples was to use perfectly safe and harmful php method to return a file size. Seems like there is not much you can do with that. Wrong!

The hacker can use it to execute malicious code because object is deserialised when using PHP magic methods. This is how PHP works. With that info you just allow the code to read your nice picture of a cat with embedded malicious code that gets injected into your application. This could allow you, for example to edit Laravel console kernel file where cron tasks are stored and add a code to run nc (netcat). Pretty scary already but it gets worse. With NC hacker can set up a connection to your server which has the same privileges as the calling process. If it happens that your cron runs as root on the server this is what hacker will get. Good night and goodbye, you have been totally hacked. Another sad news is all of that can by achieved by a 12 years old kid with not much knowledge in IT by just using the tools that are publicly available.

You can protect yourself from this happening by using validation and sanitisation. “Do not trust user input of any format”. Remember that and you can sleep well at night again.



Leave a reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.


Report this page

To report inappropriate content on this page, please use the form below. Upon receiving your report, we will be in touch as per the Take Down Policy of the service.

Please note that personal data collected through this form is used and stored for the purposes of processing this report and communication with you.

If you are unable to report a concern about content via this form please contact the Service Owner.

Please enter an email address you wish to be contacted on. Please describe the unacceptable content in sufficient detail to allow us to locate it, and why you consider it to be unacceptable.
By submitting this report, you accept that it is accurate and that fraudulent or nuisance complaints may result in action by the University.