• Sign in
  • Sign up
Elektrine
EN
  • EN English
  • 中 中文
Log in Register
Modes
Overview Search Chat Timeline Communities Gallery Lists Friends Email Vault VPN
Back to Timeline
  • Open on phpc.social

Stephen Rees-Carter :laravel:

@valorin@phpc.social
mastodon 4.5.7

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️
I hack stuff on stage for fun. 😈
I used to be found at: @valorin@infosec.exchange
#searchable

0 Followers
0 Following
Joined April 25, 2022
Social Links:
https://pinkary.com/@valorin
Newsletter:
https://securinglaravel.com
Course:
https://practicallaravelsecurity.com
Security Audits:
https://valorinsecurity.com

Posts

valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · 5d ago

As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱

❌ Bug fixes (they stopped 6 months ago)
❌ Security fixes (they stop today!)

Have you upgraded yet?

https://laravel.com/docs/releases#support-policy #Laravel

View on phpc.social
6
0
5
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Mar 09, 2026

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

https://securinglaravel.com/security-tip-your-jwt-might-be-a-forever-key/ #Laravel

View on phpc.social
1
0
4
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Mar 02, 2026

Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.

https://securinglaravel.com/security-tip-validate-config-at-boot/ #Laravel

View on phpc.social
0
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Feb 25, 2026
PSA for Statamic folks - update your sites ASAP! ⚠️ A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱 All the details: https://cvereports.com/reports/CVE-2026-27593 #Laravel
View on phpc.social
0
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Feb 23, 2026

You can't trust an email address you haven't verified, so why are you storing them in your database?

https://securinglaravel.com/in-depth-email-verification-isnt-as-simple-as-you-think/ #Laravel

View on phpc.social
2
0
3
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Feb 14, 2026

routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one?

https://securinglaravel.com/security-tip-consider-all-routes-not-just-web/

View on phpc.social
0
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Feb 05, 2026

I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again...

https://securinglaravel.com/security-tip-update-your-packages-yes-this-again

View on phpc.social
0
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Feb 04, 2026

It's been 4 months, a lot has happened, but I'm finally back to writing securinglaravel.com!

New Security Tip coming out in a few hours...

View on phpc.social
9
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Nov 18, 2025

Exhausted after #LaraconAU last week, but excited by how it all went!

I was so proud of everyone in my workshop on Wednesday - everyone had a go, and the excitement in the room as they hacked through challenges made it all worth it.

And my talk on Friday was the most absurd and crazy thing I've done on stage (which is saying something), and I've had some great feedback that's already made it worth it. No idea what I'll do next year...

View on phpc.social
2
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Oct 17, 2025

Haven't bought tickets to my Pre-Laracon AU Security Workshop yet?! 😲

I'll be locking in numbers early next week, so get your ticket TODAY or reach out to me directly. ⌛

This is your final warning... ⏰
https://events.humanitix.com/lets-hack-pre-laracon-security-workshop

#Laravel #LaraconAU

View on phpc.social
1
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Oct 08, 2025

"Let's Hack!", my Pre-Laracon Security Workshop is just FIVE weeks away! 🎉
(So is @LaraconAU... but let's be honest, priorities.)

Only 11 tickets left, & I need to confirm numbers with the venue, so if you've been thinking about it, now's the time!
👉 https://events.humanitix.com/lets-hack-pre-laracon-security-workshop

View on phpc.social
0
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Sep 29, 2025

If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands? 🤔

https://securinglaravel.com/security-tip-how-should-apis-respond-to-http/ #Laravel

View on phpc.social
7
0
5
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Sep 25, 2025

Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does?

https://securinglaravel.com/security-tip-what-is-an-httponly-cookie/ #Laravel

View on phpc.social
1
0
0
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Sep 24, 2025

Laravel Security Tip: Do You Have a Permissions Policy?

What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them?

https://securinglaravel.com/security-tip-do-you-have-a-permissions-policy/
#Laravel

View on phpc.social
2
0
1
0
valorin
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
Stephen Rees-Carter :laravel:
Stephen Rees-Carter :laravel:
@valorin@phpc.social

Friendly Hacker, Speaker, and PHP & Laravel Security Specialist.🕵️ I hack stuff on stage for fun. 😈 I used to be found at: https:// infosec.exchange/@valorin # searchable

phpc.social
@valorin@phpc.social · Sep 22, 2025

Do you reset your 2FA secret keys when a user toggles TOTP off/on?

It's not just passwords you need to worry about when it comes to authentication and stolen credentials: if an attacker can steal a 2FA secret key, they'll always have a valid TOTP! 😱

https://securinglaravel.com/security-tip-dont-forget-to-regenerate-2fa-secret-keys/ #Laravel

View on phpc.social
3
0
1
0

Media

313k7r1n3

Company

  • About
  • Contact
  • FAQ

Legal

  • Terms of Service
  • Privacy Policy
  • VPN Policy

Email Settings

IMAP: imap.elektrine.com:993

POP3: pop.elektrine.com:995

SMTP: smtp.elektrine.com:465

SSL/TLS required

Support

  • support@elektrine.com
  • Report Security Issue

Connect

Tor Hidden Service

khav7sdajxu6om3arvglevskg2vwuy7luyjcwfwg6xnkd7qtskr2vhad.onion
© 2026 Elektrine. All rights reserved. • Server: 12:12:25 UTC