> Markdown version of [/events/world-congress-2026-north-america/sessions/1420-know-your-enemies](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1420-know-your-enemies). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Know Your Enemies: Live Exploit of a PHP Engine Security Breach


- **Event:** World Congress 2026 North America

## Description

All programming languages have their foundations: the engine that interprets your code and makes everything run. In PHP, this is the Zend Engine, a critical piece of software that powers millions of applications worldwide. When everything works, you don’t even think about it. You deploy to production, and the engine does its magic behind the scenes.

But what happens when something goes wrong in that core? What if a subtle bug opens the door to a full security breach? Suddenly, the invisible foundation becomes the most important part of the story.

Let’s shine a light on two such cases: a recent, real vulnerability in the PHP engine (which has since been patched), and a backdoor that, just a few years ago, actually made it into the release candidate and allowed remote code execution. We’ll walk through how each issue could be exploited and, most importantly, what lessons developers can draw from them. And yes, there will be live, local, sandboxed demos of both exploits in action. Ready to dive in?

## Speaker

### [Alexandre Daubois](https://www.wearedevelopers.com/@alexandre-daubois)

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer


## Related talks at this congress

- [On the Public Clock: Open-Source Defense When You're Not in the Club](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1683-on-the-public-clock) — Nicholas Muy
- [The Things Your AI Isn't Telling You](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1710-the-things-your-ai) — Desmond Lamptey
- [Stop Running Mystery Meat in Production](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1726-stop-running-mystery) — Jeroen van Erp
- [Practical Threat Modeling for Software Developers](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1720-practical-threat) — Mudassir Syed

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)