PHP / Laravel Developer | Security Researcher | OSWE Certified
Germany
Joined November 2023
- Tweets69
- Following79
- Followers22
- Likes3K
Pinned Tweet
A few weeks ago, I've found a remote code execution (RCE) vulnerability in the @LaravelLivewire package. Today, the security advisory got published and received its CVE number.
CVE-2024-47823
GHSA-f3cx-396f-7jqp
Always keep your dependencies updated!
#laravel #php #cve #owasp
Yesterday, I had a really cool idea for a new laravel security feature.
Cooking right now to get this done 🙌
Jeremy Angele retweeted
The EU Chat Control proposal would be a catastrophe for Europe. It would seal Europeans behind a new digital Berlin wall, cut off from Signal and other e2e messengers. It's embarrassing and dangerous that it's gotten this close already. Time to bail to back to sanity.
We are alarmed by reports that Germany is on the verge of a catastrophic about-face, reversing its longstanding and principled opposition to the EU’s Chat Control proposal which, if passed, could spell the end of the right to privacy in Europe.
signal.org/blog/pdfs/germany…
I almost fell for it and broke the authentication for all of my routes in my #laravel application.
If you use e.g. the middleware() method after the group() statement in your routes file, it has no effect on the routes in the group.
It also doesn't throw an exception ...
A few months ago, @ffabs98 from @SBA_Research and I discovered independently two reflected #XSS vulnerabilities in the #laravel framework ( < v11.36.0 ) when APP_DEBUG is enabled.
CVE-2024-13918
CVE-2024-13919
Here are the official advisories
cve.org/CVERecord?id=CVE-202…
cve.org/CVERecord?id=CVE-202…
It's always nice to see the fruits of my labor.
The #laravel volt vulnerability just received it's #CVE number and a score of 9.3 / 10.
CVE-2025-27517
BREAKING: There is a new critical #RCE vulnerability in the @laravelphp volt package ( < v1.7.0 ) affecting every application.
Update your livewire/volt dependency to v1.7.0, ASAP!
GHSA-v69f-5jxm-hwvv
BREAKING: There is a new critical #RCE vulnerability in the @laravelphp volt package ( < v1.7.0 ) affecting every application.
Update your livewire/volt dependency to v1.7.0, ASAP!
GHSA-v69f-5jxm-hwvv
Last week, 7 of my security advisories got published for the open-source app @coolifyio. At least 3 of them are #rce vulnerabilities with a critical #cvss score.
CVE-2025-24025 (Reflected XSS)
CVE-2025-22612 (RCE)
CVE-2025-22611 (RCE)
CVE-2025-22610 (OAuth Secrets Leak)
CVE-2025-22609 (RCE)
CVE-2025-22608 (DOS)
CVE-2025-22607 (OAuth Secrets Leak)
Here is the official list of all published security advisories.
github.com/coollabsio/coolif…
If you're using the @coolifyio cloud service, you should replace the ssh keys of your servers and check for unauthorized accesses, ASAP.
Last week, 7 of my security advisories got published for the open-source app @coolifyio. At least 3 of them are #rce vulnerabilities with a critical #cvss score.
CVE-2025-24025 (Reflected XSS)
CVE-2025-22612 (RCE)
CVE-2025-22611 (RCE)
CVE-2025-22610 (OAuth Secrets Leak)
CVE-2025-22609 (RCE)
CVE-2025-22608 (DOS)
CVE-2025-22607 (OAuth Secrets Leak)
Here you can find the official security advisory.
github.com/advisories/GHSA-8…
Wow, I can't believe what I just saw... 🫣
@valorin demonstrated the Livewire RCE vulnerability, I've found a few months ago, live on stage at the #LaraconAU conference!
CVE-2024-47823
Here you can find the official security advisory.
github.com/livewire/livewire…
Jeremy Angele retweeted
📣Official statement: the new EU chat controls proposal for mass scanning is the same old surveillance with new branding.
Whether you call it a backdoor, a front door, or “upload moderation” it undermines encryption & creates significant vulnerabilities
signal.org/blog/pdfs/upload-…
