sc-lang-php

To scan a PHP codebase for security vulnerabilities, apply this skill to your Laravel, WordPress, or generic PHP project. It detects anti-patterns like unserialize() gadgets and file inclusion risks, then outputs structured findings with actionable remediation steps.

Detectable PHP security anti-patterns in Laravel and WordPress include unserialize() deserialization chains, phar deserialization, LFI/RFI, and unsafe include/require usage. The scan validates against the PHP Security Checklist to surface these common vulnerability categories.

This PHP security scanner works with Laravel, WordPress, and general PHP projects. It identifies framework-specific issues alongside generic PHP vulnerabilities like insecure data handling and file inclusion risks, applying the PHP Security Checklist across all project types.

To fix unserialize() deserialization vulnerabilities in PHP, review the structured findings generated by the scan. It identifies specific unsafe deserialization chains and provides actionable remediation guidance to help developers harden the code before deployment.

The best way to detect file inclusion risks in WordPress plugins is running a targeted security scan. This process identifies LFI/RFI patterns and unsafe include/require usage, validating the codebase against the PHP Security Checklist to output actionable remediation steps.