How one Owner could take over any account in another company — cross-tenant IDOR in InvoiceShelf (CVE-2026-55610)
TL;DR
InvoiceShelf (self-hosted, multi-company invoicing) let any company Owner read and overwrite any user in any other company on the sa
php
dev.to
Aug 05, 2026
How to Monitor Your Laravel Application with Vigilmon
Laravel powers millions of production applications — from SaaS products to e-commerce platforms to API backends. But Laravel's elegance doesn't preven
php
dev.to
Aug 05, 2026
Don't show users a raw Playwright error — translating exceptions into friendly messages
When something fails in Playwright, the exception message comes with a long block of debug information starting with Call log:. That's useful while de
php
dev.to
Aug 05, 2026
Introducing Nucleus: A Linux-Native Dashboard for LAMP Stack Management
The Problem
I'm the developer behind Laragon Dashboard (53 stars on GitHub) — a control panel for the Laragon local dev stack on Windows. I
php
dev.to
Aug 05, 2026
Your Laravel Models Aren’t the Problem. Hidden Workflows Are.
Most Laravel applications do not become difficult to maintain because somebody made one obviously terrible architectural decision. They get there thro
php
dev.to
Aug 04, 2026
Building a Sliding Window Rate Limiter for a Video API With Redis
Last month our trending-videos endpoint started returning garbage latency numbers. Not because the queries got slower, but because a handful of client
php
dev.to
Aug 04, 2026
I gave my schema viewer your app's colours
Truss is a live, zoomable ER diagram of your Laravel app's actual database schema, safe to run in production because it only ever reads structure. I i
php
dev.to
Aug 04, 2026
Broken Access Control in Laravel — Why Being Logged In Isn't Enough
This is the tenth article in a series on PHP and Laravel application security.
So far we have covered:
Detecting SQL injection attempts in PHP logs
php
dev.to
Aug 04, 2026
How to Monitor Your Symfony Application with Vigilmon
How to Monitor Your Symfony Application with Vigilmon
Symfony is one of the most robust PHP frameworks available. This guide shows how to a
php
dev.to
Aug 04, 2026
How to Monitor Your Laravel Application with Vigilmon
How to Monitor Your Laravel Application with Vigilmon
Laravel powers millions of applications worldwide. When your Laravel app goes down, y
php
dev.to
Aug 04, 2026
Magento 2 Tax Calculation Performance Optimization
Tax calculation is one of those invisible performance bottlenecks in Magento 2 that rarely gets attention until checkout starts dragging. Every produc
php
dev.to
Aug 04, 2026
Breaking the Monolith - Part 2: Who Owns a Hash Function
Part 1 was a bug story: a 200 OK that saved nothing. This is the design story underneath it - why the ownership of a hash function stopped being an im
php
dev.to
Aug 04, 2026
How to Monitor Your Laravel Octane Application with Vigilmon
How to Monitor Your Laravel Octane Application with Vigilmon
Laravel Octane supercharges your Laravel application by running it on high-per
php
dev.to
Aug 04, 2026
Building a Video CDN Edge Cache Layer With Varnish and ESI Fragments
Our trending page for the Japanese region was doing 40,000 requests a minute during prime time, and every single one of them was rebuilding the same H
php
dev.to
Aug 04, 2026
The Repository Pattern in Laravel, When It's Worth It and When It's Just Extra Folders
Eloquent is genuinely good, expressive enough that you write a working query in one line and move on with your day. Which is exactly why the repositor
php
dev.to
Aug 04, 2026
Guaranteeing Event Delivery: Laravel Outbox Pattern 📦
The Fatal Flaw of the Dual-Write
In modern microservice architectures, or even well-structured modular monoliths, a single business action often requ
php
dev.to
Aug 04, 2026
Automating Perfex CRM with a REST API: webhooks, OpenAPI and MCP for AI agents
Full disclosure up front: we build the module discussed here. This is Themesic Interactive's own writeup of the REST API module for Perfex CRM. Every
php
dev.to
Aug 03, 2026
The Easiest Way to Look Up GeoIP in Laravel
IP location data is useful when your Laravel application needs a sensible regional default, timezone context, analytics enrichment, or an additional r
php
dev.to
Aug 03, 2026
From a 10-Minute Nap to 300+ Installs: The Story of My 'Restrict WP Upload Type' Plugin
📼 It Started With WordPress 4.7
I still remember the version number: WordPress 4.7. That's when I properly started my journey as a WordPres
php
dev.to
Aug 03, 2026
Welcome back to PHP
I left programming in PHP when isset() was a lifestyle, array() had just become [], and types lived in docblocks where the runtime couldn't see them.
php
dev.to
Aug 03, 2026