Neura Market
jvoisin/snuffleupagus logo

jvoisin/snuffleupagus

Free

Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About jvoisin/snuffleupagus

Snuffleupagus is a security module for PHP 7+ and 8+ designed to drastically raise the cost of attacks against websites by killing entire bug classes and providing a powerful virtual-patching system. It allows administrators to fix specific vulnerabilities and audit suspicious behaviors without modifying PHP code. Key features include no noticeable performance impact, simple virtual-patching rules, and hardening capabilities such as automatic secure and samesite cookies, global strict mode, type-juggling prevention, stream wrapper whitelisting, and TLS certificate validation enforcement. The project has a comprehensive test suite with near 100% coverage, enforced code style, and extensive documentation.

Key Features

No noticeable performance impact
Powerful virtual-patching rules that are simple to write
Kills multiple vulnerability classes: unserialize-based code execution, mail-based code execution, cookie-stealing XSS, file-upload based code execution, weak PRNG, XXE, filter-based remote code execution
Hardening features: automatic secure and samesite flags for cookies, global strict mode, type-juggling prevention, whitelisting of stream wrappers, preventing writable file execution, whitelist/blacklist for eval, enforcing TLS certificate validation when using curl
Bundled set of rules to detect post-compromise behaviors
Request dumping capability for debugging
Comprehensive test suite with close to 100% coverage
Comprehensive documentation and example rules
Usage of static analysis tools: coverity, codeql, scan-build

Pros & Cons

Pros
  • No noticeable performance impact, making it suitable for production
  • Comprehensive protection against many vulnerability types
  • Simple rule syntax for virtual-patching and hardening
  • Actively maintained with a strong testing and code-quality culture
  • Detailed documentation and example rules available
Cons
  • Requires installation as a PHP module (compilation or package installation)
  • Only supports PHP 7 and 8, not older versions
  • Not a standalone application; must be integrated into existing PHP setups

Best For

Securing PHP web applications against common and complex vulnerabilitiesVirtual-patching to fix specific security issues without modifying application codeHardening PHP environments to prevent exploitation of entire bug classesAuditing and monitoring suspicious behavior in production PHP applications