For WordPress administrators
Clear remediation steps and signs that need investigation.
BitFire security research
WordPress security research, explained.
Learn how real vulnerabilities work, what a firewall can and cannot stop, and how to write safer PHP—without needing to be a security specialist.
For PHP developers
The code path behind a flaw and patterns that make intent easier to verify.
For security teams
Dated methodology, explicit limitations, and links to primary sources.
Research library
Turn a finding into a practical decision.
BitFire Research turns security findings into practical decisions. Vulnerability articles begin with the update or recovery action a site owner should take. Technical sections then explain the request, authorization mistake, or protected operation for developers who want to understand the code path.
01PHP development
Typed collections in PHP: safer lists and better autocomplete
PHP arrays can hold almost anything, which makes their contents hard to understand at a glance. Build a small typed collection that gives your IDE useful type information and rejects the wrong object at runtime.
Read the PHP guide
02WordPress vulnerability · CVE-2023-28121
WooPayments authentication bypass: how to update and check your site
Older WooCommerce Payments releases could let an unauthenticated request act as an administrator. Learn which versions were affected, what to update, and what evidence to review if the plugin was active on your store.
Read the recovery guide
03Historical firewall test · CVE-2023-4596
What a Forminator file-upload test teaches us about layered security
A 2023 lab test followed an unauthenticated upload from the first bot request to PHP execution. See where different defensive layers had an opportunity to stop it—and why updating the plugin remains the first action.
Review the historical testSuggest a research topic
What should we explain next?
Tell us about a confusing vulnerability, defensive claim, or PHP security pattern. Useful research starts with a practical question.