“How we broke PHP, hacked Pornhub and earned $20,000”

2016-07-24

It all started by auditing Pornhub, then PHP and ended in breaking both… We have gained remote code execution on pornhub.com and have earned a $20,000 bug bounty on Hackerone. We have found two use-after-free vulnerabilities in PHP's garbage collection algorithm. Those vulnerabilities were remotely exploitable over PHP's unserialize function.

Keys

Generate pseudorandom passwords with OpenSSL

2015-11-17

OpenSSL comes in handy when you need to generate passwords or random strings. For example for system accounts and services. In this short post I'll give you a quick example on how to generate random passwords with OpenSSL in Linux (Bash), Windows and PHP.

blue elephant plush toy on black laptop computer -- Photo by Ben Griffiths

Optimize PHP’s OPcache configuration

2015-07-01

Optimize PHP's OPcache configuration and make OPcache perform even better. After configuring and optimizing PHP's realpath_cache_size, the OPcache cache mechanism is the next step to fine-tune. With just a few tweaks you tune OPcache to perform much better

blue elephant plush toy on black laptop computer -- Photo by Ben Griffiths

How to set a good PHP realpath_cache_size

2014-10-23

Learn how to optimize PHP performance by checking and setting PHP realpath_cache_size. The realpath_cache_size size represents the total number of bytes in the path strings stored, plus the size of the data associated with the cache entry

blue elephant plush toy on black laptop computer -- Photo by Ben Griffiths

Check website availability with PHP and cURL

2014-09-10

A useful PHP script to check if your website is up and online available. It uses PHP and cURL. This script comes in handy because website uptime and availability is important, and you want your website to be always online available.