August 2018 Summaries

SonarSource is a company with a strong product-first culture that values cultural fit and team-oriented approach. The hiring process was unique in that it involved multiple video conferences with various team members, including the CEO, to assess compatibility and goals. This approach allowed for a deeper understanding of the company's values and objectives, which ultimately led to a successful employment offer. The company invests significant time and resources into its hiring process, which is a rare exception in the industry.

The security researcher Sam Thomas discovered a new exploitation technique that can lead to critical PHP object injection vulnerabilities without using the PHP function unserialize(), which enables attackers to escalate file-related vulnerabilities to remote code execution. The technique leverages the Phar (PHP Archive) wrapper, which stores meta data in serialized format, allowing an attacker to inject malicious objects into the application's scope by manipulating Phar files, potentially leading to further vulnerabilities such as code injection and remote code execution.