markus staab | @[email protected] @markusstaab

open-source lover, creator of staabm/phpstan-dba, extensive freetime @phpstan, @rectorphp and #phpunit contributor #sabredav, #amphp, #redaxo staabm.github.io germany Joined December 2011

Tweets

10K
Followers

882
Following

140
Likes

9K

markus staab | @[email protected] @markusstaab

11 hours ago

@maks_rafalko @infection_php Yes, we have one based on Hoa\Regex in phpstan-src I described a few use-cases on staabm.github.io/2024/07/05/arr…

0 0 1 34 0

View Details

markus staab | @[email protected] @markusstaab

12 hours ago

working on more precise #phpstan types, based on regex AST - lets make use of the new decimal-int-string type.

2 0 8 372 0

View Details

Alexandre Daubois @alexdaubois

5 days ago

Type juggling has been exploited in real #PHP authentication bypasses. Here's the classic: if ($userInput == $storedHash) { // login success } If $storedHash starts with "0e" followed by digits (like "0e462097"), PHP treats it as scientific notation: 0 * 10^462097 = 0. An attacker just needs to find an input whose MD5 also starts with "0e" + digits. Both sides evaluate to 0. 0 == 0 is true. Known "magic hashes": - MD5("240610708") = 0e462097... - MD5("QNKCDZO") = 0e830400... - SHA1("aaroZmOk") = 0e00000... Fix: use === everywhere. Or better: hash_equals() for timing-safe comparison. Never == for security checks.

1 8 62 3K 15

View Details

markus staab | @[email protected] @markusstaab

5 days ago

You might remember #PHPStan supports array-shapes for $matches in preg_match*() since ~June 2024. RegEx AST based inference implemented before AI was even a thing. Today I realized that we can re-use the existing RegEx inference for $subject :-). phpstan.org/r/8b12686a-f8c…

0 0 4 273 0

View Details

markus staab | @[email protected] @markusstaab

5 days ago

@alexdaubois since I recently added PHPStan rules to enforce use of #[SensitiveParameter] you might just give me a idea for a new opinionated rule to check whether such secrets are compared using hash_equals()

1 0 7 218 1

View Details

Jordi Boggiano @seldaek

7 days ago

Composer 2.10 is out. Native malware filtering via @AikidoSecurity, enabled by default on @packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with. #php #phpc #composerphp

9 85 332 25K 56

View Details

Ondřej Mirtes @OndrejMirtes

7 days ago

PHPStan 2.2: Unsealed Array Shapes, Safer Array Keys, and More! phpstan.org/blog/phpstan-2…

4 16 50 4K 12

View Details

The PHP Foundation @ThePHPF

a week ago

Today we published our Impact and Transparency Report for 2025. We are incredibly grateful for our sponsors, partners, contractors, and individual financial contributors for without them, none of our work would be possible. 💙 🐘thephp.foundation/blog/2026/05/2… #php #opensource

1 20 52 2K 4

View Details

Ondřej Mirtes @OndrejMirtes

a week ago

Goodbye PHPStan 2.1.x 👋 It's been nice 18 months. github.com/phpstan/phpsta… Now onto PHPStan 2.2.0. It's coming on Thursday.

3 9 65 3K 2

View Details

@

2 weeks ago

I've added rules to @rectorphp for this---give them a shot!

@

57 years ago

0 0 0 0 0

5 3 17 5K 4

View Details

markus staab | @[email protected] @markusstaab

2 weeks ago

Togehter with @OndrejMirtes I will be at #neoscon to see what this awesome community has built over the years. see you there

0 1 4 417 0

View Details

GitHub @github

2 weeks ago

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

584 4K 11K 7.5M 4K

View Details

Packagist @packagist

2 weeks ago

If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc

Packagist @packagist

3 weeks ago

🚨 Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages. Update now (composer self-update) or disable affected Actions workflows. #composerphp #phpc #php

5 94 213 92K 87

3 40 112 30K 34

View Details

markus staab | @[email protected] @markusstaab

2 weeks ago

In case you are using global userland constants in PHP and you configured their types in the @phpstan configuration, starting with todays release we will error about invalid values in define() or const definitions (bleeding edge only). phpstan.org/config-referen…

0 0 4 181 1

View Details

PHPStan @phpstan

2 weeks ago

New release: PHPStan 2.1.55 github.com/phpstan/phpsta… #phpstan

0 1 3 346 0

View Details

Infection PHP @infection_php

3 weeks ago

Infection 0.33.0 has been released. - Testo test framework support (by @roxblnfk) - Allow using the full width of the terminal for console output Enjoy!

2 3 11 2K 1

View Details

Infection PHP @infection_php

3 weeks ago

Do you use Infection with AI-generated code/tests? If so, what is the workflow / skills / prompts? Is there anything we need to improve here to make it more useful?

4 4 10 939 0

View Details

Lars Moelleken @suckup_de

3 weeks ago

GitHub Copilot is moving to usage-based billing 💸 "Starting June 1, 2026, Copilot usage will be measured in AI Credits (AICs) instead of Premium Requests (PRUs). 1 AIC = $0.01." copilot-billing-preview.github.com

1 1 2 510 1

View Details

PHP UK Conference @PHPUKConference

2 months ago

In case you missed it 👀 @OndrejMirtes delivered an excellent session on “Crafting Custom PHPStan Rules” at PHP UK 2026. Learn how to write custom PHPStan rules to enforce project standards, catch domain-specific bugs, and automate repetitive code review tasks. Watch the full talk below ⬇️ youtu.be/r6oc4Ctor4c?si…