proomt

Search

Search posts, papers, and topics

All posts

LaravelYannick Lyn Fatt5 min readintermediate

Laravel Scalpel Scans for Filesystem Intrusion Evidence

Read on laravel-news.com

Summary

Laravel Scalpel is a Laravel‑native scanner that looks for post‑deployment filesystem tampering – rogue PHP files, obfuscated backdoors, altered .htaccess/.user.ini, missing or mis‑configured .env, and diffs against a signed baseline. It ships with six built‑in scanners, baseline snapshot commands, fast vs strict hashing modes, CI‑friendly output (JSON, SARIF, GitHub annotations) and a ScanFinish…

  • Runs inside the app, so it inherits the same permissions – an attacker with code access could also tamper with the scanner.
  • Baseline command records SHA‑256, size, mtime for every file; diff reports added/modified/deleted files. Supports HMAC‑signed baselines for integrity.
  • Structural scanner flags executable PHP in public/storage (including double extensions) with allow‑lists for index.php, vendor, compiled views.
  • Obfuscated‑code scanner looks for eval(base64_decode()), dynamic calls, long encoded strings; patterns can be disabled per config.

Detecting evidence of a breach after deployment is a missing piece in many Laravel CI pipelines, which usually focus on static analysis and dependency checks. Scalpel gives teams a way to verify that the running codebase hasn't been silently altered, and its baseline signing adds a tamper‑evident l…

6/10
securityciphplaravelfilesystem

Related reading

  1. Laravel Vet: Review Composer Code Before It Installs

    Laravel Vet is a Composer plugin that intercepts installs/updates, shows the diff of each package, and lets you approve changes manually or via an LLM‑based coding agent. Trusted packages are recorded in a `vet.json` with a content hash, so future updates only prompt for new changes. The tool exits with an error on untrusted code, making it CI‑friendly, and works with any PHP project using Compos…

    Laravellaravel-news.com4 min

  3. APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport

    APort Vault is a benchmark that replays 4,371 human‑written attacks against a live payment‑handling AI agent across 14 models and multiple policy configurations, generating 225,964 evaluations. Adding the Open Agent Passport pre‑action check eliminated all unauthorized transfers in the test, showing a per‑session breach upper bound of 0.38%.

    Hugging Face Daily Papersarxiv.org2 minpaper

  4. Mercure Broadcasting in Laravel 13.32

    Laravel 13.32.0 adds a Mercure broadcast driver (SSE‑based real‑time), new FilesystemAdapter methods copyToDisk()/moveToDisk() for cross‑disk file moves, and enum support in Queue pause/resume APIs. Minor tweaks include default Cloud exit codes, collection return‑type fixes, and Mercure installer integration.

    Laravellaravel-news.com3 minrelease

  5. When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

    Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…

    Cloudflarecloudflare.com21 minHN2

  6. Laravel MCP 1.0 Is Released

    Laravel MCP 1.0 ships with the 2026-07-28 protocol, adding searchable tool catalogs, cache hints, stateless request handling, and PKCE‑required OAuth with client‑metadata support. The release includes migration guidance and new headers for versioned RPC calls.

    Laravellaravel-news.com3 minrelease