Page 3 - Security/OWASP

An upload form is one of the most direct attack surfaces of a PHP application, because it lets an attacker put fully controlled content onto the server. Relying solely on the file extension or the content type sent by the client opens the door to remote code execution, path traversal and injected script files disguised as harmless images.

An API key that has stayed unchanged for three years looks harmless on the surface as long as nothing goes wrong. That is exactly the problem: if the key was ever compromised, through a leaked log, an accidentally public repository, or a compromised third party, the window for an attacker stays open until someone actively swaps the key. Automated rotation closes that window systematically, without manual intervention and without taking applications down.

Insecure REST APIs are not a rare occurrence. They do not arise from bad intentions but from missing security layers in a growing codebase. Authentication gaps, missing rate limiting, unvalidated input, SSRF vectors and mass assignment weaknesses are the most common findings in API security reviews, and they can be closed systematically with clear patterns.

PhpStorm's default profile is built for generic PHP and rarely matches the conventions of a grown Magento project one to one. If every developer only adjusts their inspection profile locally, each sees different warnings, which makes code reviews unnecessarily harder. This article shows how to define a custom profile as a team standard and version it via .idea/inspectionProfiles in the project repository, so every developer sees the same code quality warnings automatically on checkout.

PATH hijacking exploits the fact that Bash scripts resolve commands through an inherited, potentially manipulated PATH variable instead of using fixed, trusted paths. This article shows how a manipulated PATH or IFS tricks a script into running someone else's programs, why cron jobs and systemd units are especially affected, and which concrete measures harden Bash scripts against this attack pattern.

Image scanning finds known vulnerabilities before startup, but once a container is running, much stays invisible. Falco watches system calls directly in the kernel and detects in real time when a process inside a container behaves differently than expected, for example an unexpected shell, a write to sensitive paths, or an escape attempt.

Encryption at rest protects data on stolen drives, in exposed backups, and in misconfigured cloud storage buckets, but it does not replace application security, since a running application decrypts data for access. This article shows how database, filesystem, and field-level encryption work together and why key management is the actual challenge.

Anyone embedding JavaScript or CSS from an external CDN is trusting that the provider will never be compromised. Subresource Integrity replaces that blind trust with a cryptographic checksum the browser verifies against the actual file content before execution, making silent supply chain attacks technically visible.

A permissively set Access-Control-Allow-Origin header lifts exactly the browser protection the Same-Origin Policy is meant to guarantee. This article explains preflight requests, the dangerous combination of wildcard and credentials, origin reflection as the most common mistake, and how a clean, server-side allowlist keeps working reliably for Magento APIs behind a CDN and Varnish.

A misconfigured or completely missing Content Security Policy leaves the door wide open for cross site scripting attacks, even when the rest of the code is clean. This article walks through building directives like script src and frame ancestors correctly, using report only mode for a safe rollout, and hardening the policy specifically for Magento and Hyva storefronts.