Hunting Vulnerabilities in PHP with LLMs

Talk given at the
IPC Munich September 2027

Hackers are already using Large Language Models to map your attack surface, it’s time you used them to defend it.

While we’ve spent years trying to write the perfect regex or rule-set to catch bugs, LLMs have unlocked a terrifyingly effective ability to understand the intent and context of our Symfony and PHP code.

This session dives into the practical reality of using AI as an autonomous security researcher to uncover deep-seated vulnerabilities in Symfony applications that traditional tools simply cannot see.

We will explore how to architect a high-speed security pipeline that feeds your codebase to an LLM to detect broken access control, complex injection paths, and logic flaws in real-time.

You’ll walk away with a battle-tested strategy to weaponize AI against your own technical debt, turning the most unpredictable technology of our time into your most meticulous security auditor.

Transcript

1. Hunting Vulnerabilities in PHP with LLMs @vinceAmstoutz
2. Vincent Amstoutz EXPERT BACKEND DEVELOPER @Swikly | Also freelance (Part-time) MAIN OSS CONTRIBUTIONS Creator of Symfony Security Auditor API Platform Core Team FrankenPHP Symfony
3. Vincent Amstoutz EXPERT BACKEND DEVELOPER @Swikly | Also freelance (Part-time) MAIN OSS CONTRIBUTIONS Creator of Symfony Security Auditor FrankenPHP API Platform Core Team @vinceAmstoutz https://vince-amstoutz.tech Symfony
4. What is a Vulnerability? A CVE? @vinceAmstoutz
5. What is a Vulnerability? A CVE? CVE-2026-102279 @vinceAmstoutz
6. What is a Vulnerability? A CVE? CVE-2026-102279 Severity: Low 3.1/ 10 @vinceAmstoutz
7. What is a Vulnerability? A CVE? CVE-2026-102279 Severity: Low 3.1/ 10 @vinceAmstoutz
8. What is a Vulnerability? A CVE? @vinceAmstoutz
9. The Evolving Threat Source: https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access, May 2026 @vinceAmstoutz
10. Why Traditional Tools Fail? @vinceAmstoutz
11. Why Traditional Tools Fail? Syntax vs. Intent Legacy SAST tools rely on "Regex patterns". @vinceAmstoutz
12. Why Traditional Tools Fail? Syntax vs. Intent Context is King Legacy SAST tools rely on "Regex patterns". LLMs understand the deep relationship between a Controller, a Voter, and the Database. @vinceAmstoutz
13. Comparaison Between Tools Source: https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access, May 2026 @vinceAmstoutz
14. Comparison (updated) Image generated with the help of AI @vinceAmstoutz
15. Problems caused @vinceAmstoutz
16. Problems caused 1 Hyper-Accelerated Discovery Fast zero-day discovery. @vinceAmstoutz
17. Problems caused 1 2 Hyper-Accelerated Discovery Instant Weaponization Fast zero-day discovery. Fast zero-day implementation. @vinceAmstoutz
18. Problems caused 1 2 3 Hyper-Accelerated Discovery Instant Weaponization Democratization of Elite Hacking Fast zero-day discovery. Fast zero-day implementation. It levels up low-skilled attackers. @vinceAmstoutz
19. Beyond Simple Bugs https://owasp.org/projects/top-ten @vinceAmstoutz
20. Beyond Simple Bugs 50+ vulnerability types covering OWASPaligned categories https://owasp.org/projects/top-ten @vinceAmstoutz
21. Beyond Simple Bugs @vinceAmstoutz
22. Beyond Simple Bugs Complex Injection Paths @vinceAmstoutz
23. Beyond Simple Bugs Complex Injection Paths Logic Flaws @vinceAmstoutz
24. Beyond Simple Bugs Complex Injection Paths Broken Access Control Logic Flaws @vinceAmstoutz
25. Beyond Simple Bugs Complex Injection Paths Broken Access Control Logic Flaws And dozens more! @vinceAmstoutz
26. Beyond Simple Bugs @vinceAmstoutz
27. Beyond Simple Bugs Complex Injection Paths @vinceAmstoutz
28. Beyond Simple Bugs Complex Injection Paths 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 // src/Controller/ProductController.php // ... class ProductController extends AbstractController { #[Route('/products', name: 'app_products', methods: ['GET'])] public function list(Request $request, ProductRepository $repository): Response { $sortBy = $request->query->get('sort_by', 'name'); $direction = $request->query->get('direction', 'ASC'); $products = $repository->findSortedProducts($sortBy, $direction); return $this->render('product/list.html.twig', ['products' => $products]); } } @vinceAmstoutz
29. Beyond Simple Bugs Complex Injection Paths 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 // src/Controller/ProductController.php // ... class ProductController extends AbstractController { #[Route('/products', name: 'app_products', methods: ['GET'])] public function list(Request $request, ProductRepository $repository): Response { $sortBy = $request->query->get('sort_by', 'name'); $direction = $request->query->get('direction', 'ASC'); $products = $repository->findSortedProducts($sortBy, $direction); return $this->render('product/list.html.twig', ['products' => $products]); } } @vinceAmstoutz
30. Beyond Simple Bugs Complex Injection Paths 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 // src/Controller/ProductController.php // ... class ProductController extends AbstractController { #[Route('/products', name: 'app_products', methods: ['GET'])] public function list(Request $request, ProductRepository $repository): Response { $sortBy = $request->query->get('sort_by', 'name'); $direction = $request->query->get('direction', 'ASC'); $products = $repository->findSortedProducts($sortBy, $direction); return $this->render('product/list.html.twig', ['products' => $products]); } } @vinceAmstoutz
31. Beyond Simple Bugs Complex Injection Paths @vinceAmstoutz
32. Beyond Simple Bugs Complex Injection Paths 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 // src/Repository/ProductRepository.php // ... class ProductRepository extends ServiceEntityRepository { // ... public function findSortedProducts(string $sortBy, string $direction): array { return $this->createQueryBuilder('p') ->orderBy('p.' . $sortBy, $direction) ->getQuery() ->getResult(); } } @vinceAmstoutz
33. Beyond Simple Bugs Complex Injection Paths 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 // src/Repository/ProductRepository.php // ... class ProductRepository extends ServiceEntityRepository { // ... public function findSortedProducts(string $sortBy, string $direction): array { return $this->createQueryBuilder('p') ->orderBy('p.' . $sortBy, $direction) ->getQuery() ->getResult(); } } @vinceAmstoutz
34. Beyond Simple Bugs Broken Access Control @vinceAmstoutz
35. Beyond Simple Bugs Broken Access Control 1 2 3 4 5 6 7 8 9 10 11 12 13 14 // src/Controller/InvoiceController.php // ... #[Route('/api')] #[IsGranted('ROLE_USER')] class InvoiceController extends AbstractController { #[Route('/invoice/{id}', methods: ['GET'])] public function show(Invoice $invoice): JsonResponse { return $this->json($invoice); } } @vinceAmstoutz
36. Beyond Simple Bugs Logic Flaws @vinceAmstoutz
37. Beyond Simple Bugs Logic Flaws 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 // src/Controller/ProfileController.php // ... class ProfileController extends AbstractController { #[Route('/profile/update-password', methods: ['POST'])] public function updatePassword(...): Response { $targetUserId = $request->request->get('user_id'); $userToUpdate = $userRepository->find($targetUserId); // Update password etc return $this->redirectToRoute('app_profile_success'); } } @vinceAmstoutz
38. Can we improve this?
39. Target: Security In Our Projects @vinceAmstoutz
40. The Autonomous Researcher Pipeline @vinceAmstoutz
41. The Autonomous Researcher Pipeline 1. Ingestion Feeds project files @vinceAmstoutz
42. The Autonomous Researcher Pipeline Mapping Retrieves related Services, Voters, Entities, etc 2. 1. Ingestion Feeds project files @vinceAmstoutz
43. The Autonomous Researcher Pipeline Mapping Retrieves related Services, Voters, Entities, etc 2. 1. 3. Ingestion Audit Feeds project files Multi-agent analysis: Attacker vs. Reviewer loop @vinceAmstoutz
44. The Autonomous Researcher Pipeline Mapping Report Retrieves related Services, Voters, Entities, etc Auto-generating the list of validated vulnerabilities 2. 4. 1. 3. Ingestion Audit Feeds project files Multi-agent analysis: Attacker vs. Reviewer loop @vinceAmstoutz
45. 6k+ downloads @vinceAmstoutz
46. symfony-security-auditor @vinceAmstoutz
47. symfony-security-auditor @vinceAmstoutz
48. symfony-security-auditor @vinceAmstoutz
49. symfony-security-auditor @vinceAmstoutz
50. Image generated with the help of AI @vinceAmstoutz
51. Main Features @vinceAmstoutz
52. Main Features Secret-safe by default @vinceAmstoutz
53. Main Features Secret-safe by default Multi-agent loop @vinceAmstoutz
54. Main Features Secret-safe by default Multi-agent loop Token @vinceAmstoutz
55. Main Features Secret-safe by default Multi-agent loop Token 9 output formats @vinceAmstoutz
56. Main Features Secret-safe by default Multi-agent loop Token 9 output formats Extension first @vinceAmstoutz
57. Main Features Secret-safe by default Multi-agent loop Token 9 output formats Extension first Baseline @vinceAmstoutz
58. Main Features Secret-safe by default Multi-agent loop Token 9 output formats Extension first Baseline MCP support (beta) @vinceAmstoutz
59. Main Features Secret-safe by default Multi-agent loop Token 9 output formats Extension first Baseline MCP support (beta) CI ready @vinceAmstoutz
60. Main Features Secret-safe by default Multi-agent loop Token 9 output formats Extension first Baseline MCP support (beta) CI ready Standalone binary with self update @vinceAmstoutz
61. symfony-security-auditor @vinceAmstoutz
62. Demo @vinceAmstoutz
63. Demo Install and setup @vinceAmstoutz
64. Demo Install and setup Security report @vinceAmstoutz
65. Demo Install and setup Security report Fix issues @vinceAmstoutz
66. Demo Install and setup Security report Fix issues Deploy @vinceAmstoutz
67. Install And Setup MacOS, Linux or WSL curl -fsSL https://raw.githubusercontent.com/vinceAmstoutz/symfony-security-auditor/main/install.sh | SSA_INIT=1 sh Native Windows irm https://raw.githubusercontent.com/vinceAmstoutz/symfony-security-auditor/main/install.ps1 | iex https://github.com/vinceAmstoutz/symfony-security-auditor#getting-started @vinceAmstoutz
68. All-In-One Setup @vinceAmstoutz
69. Manual Setup @vinceAmstoutz
70. Doctor Command @vinceAmstoutz
71. Dry run @vinceAmstoutz
72. Show scanned files @vinceAmstoutz
73. Audit Run @vinceAmstoutz
74. Re-run The Audit @vinceAmstoutz
75. Fix and Audit Again @vinceAmstoutz
76. Library Extension
77. Command Line Interface Bundle Version Standalone Version bin/console audit [...] symfony-security-auditor audit [...] @vinceAmstoutz
78. Extension - Configuration @vinceAmstoutz
79. Extension - Configuration composer require vinceAmstoutz/symfony-security-auditor @vinceAmstoutz
80. Extension - Configuration composer require vinceAmstoutz/symfony-security-auditor https://github.com/symfony/recipes-contrib/tree/main/vinceamstoutz/symfony-security-auditor @vinceAmstoutz
81. Extension - Configuration @vinceAmstoutz
82. Extension - Configuration # config/packages/ai.yaml ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' @vinceAmstoutz
83. Extension - Configuration # config/packages/ai.yaml ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' # config/packages/symfony_security_auditor.yaml symfony_security_auditor: model: 'claude-sonnet-5-5' @vinceAmstoutz
84. Extension - Configuration composer require symfony/ai-anthropic-platform # config/packages/ai.yaml ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' # config/packages/symfony_security_auditor.yaml symfony_security_auditor: model: 'claude-sonnet-5-5' @vinceAmstoutz
85. Extension - Configuration composer require symfony/ai-anthropic-platform # config/packages/ai.yaml ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' # config/packages/symfony_security_auditor.yaml symfony_security_auditor: model: 'claude-sonnet-5-5' 1 # config/bundles.php 2 3 return [ 4 // ... 5 Symfony\AI\AiBundle\AiBundle::class => ['all' => true], 6 VinceAmstoutz\SymfonySecurityAuditor\SymfonySecurityAuditorBundle::class => [ 7 'dev' => true, 8 'test' => true 9 ], 10 ]; @vinceAmstoutz
86. Extension - Configuration composer require symfony/ai-anthropic-platform # config/packages/ai.yaml ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' # config/packages/symfony_security_auditor.yaml symfony_security_auditor: model: 'claude-sonnet-5-5' 1 # config/bundles.php 2 3 return [ 4 // ... 5 Symfony\AI\AiBundle\AiBundle::class => ['all' => true], 6 VinceAmstoutz\SymfonySecurityAuditor\SymfonySecurityAuditorBundle::class => [ 7 'dev' => true, 8 'test' => true 9 ], 10 ]; bin/console audit [...] @vinceAmstoutz
87. CI Support + GitLab support @vinceAmstoutz
88. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 # .github/workflows/security-audit.yaml name: Security Audit on: schedule: - cron: '0 2 * * *' workflow_dispatch: ~ # nightly at 02:00 UTC # allow manual trigger permissions: contents: read security-events: write # required for the Code Scanning upload jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - name: Symfony Security Audit uses: vinceamstoutz/symfony-security-auditor@1.22.0 env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} with: since: origin/${{ github.base_ref }} baseline: .security-baseline.json format: sarif output: report.sarif - uses: github/codeql-action/upload-sarif@v4 # ... @vinceAmstoutz
89. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 # .github/workflows/security-audit.yaml name: Security Audit on: schedule: - cron: '0 2 * * *' workflow_dispatch: ~ # nightly at 02:00 UTC # allow manual trigger permissions: contents: read security-events: write # required for the Code Scanning upload jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - name: Symfony Security Audit uses: vinceamstoutz/symfony-security-auditor@1.22.0 env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} with: since: origin/${{ github.base_ref }} baseline: .security-baseline.json format: sarif output: report.sarif - uses: github/codeql-action/upload-sarif@v4 # ... @vinceAmstoutz
90. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 # .github/workflows/security-audit.yaml name: Security Audit on: schedule: - cron: '0 2 * * *' workflow_dispatch: ~ # nightly at 02:00 UTC # allow manual trigger permissions: contents: read security-events: write # required for the Code Scanning upload jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - name: Symfony Security Audit uses: vinceamstoutz/symfony-security-auditor@1.22.0 env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} with: since: origin/${{ github.base_ref }} baseline: .security-baseline.json format: sarif output: report.sarif - uses: github/codeql-action/upload-sarif@v4 # ... @vinceAmstoutz
91. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 # .github/workflows/security-audit.yaml name: Security Audit on: schedule: - cron: '0 2 * * *' workflow_dispatch: ~ # nightly at 02:00 UTC # allow manual trigger permissions: contents: read security-events: write # required for the Code Scanning upload jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - name: Symfony Security Audit uses: vinceamstoutz/symfony-security-auditor@1.22.0 env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} with: since: origin/${{ github.base_ref }} baseline: .security-baseline.json format: sarif output: report.sarif - uses: github/codeql-action/upload-sarif@v4 # ... @vinceAmstoutz
92. Pros @vinceAmstoutz
93. Pros Finds logic-level flaws that traditional tools structurally miss @vinceAmstoutz
94. Pros Finds logic-level flaws that traditional tools structurally miss Dual-agent verification reduces false positives @vinceAmstoutz
95. Pros Finds logic-level flaws that traditional tools structurally miss Dual-agent verification reduces false positives Provider-agnostic @vinceAmstoutz
96. Pros Finds logic-level flaws that traditional tools structurally miss Dual-agent verification reduces false positives Provider-agnostic Low cost compared to manual pentesting or commercial DAST tools @vinceAmstoutz
97. Pros Cons Finds logic-level flaws that traditional tools structurally miss Dual-agent verification reduces false positives Provider-agnostic Low cost compared to manual pentesting or commercial DAST tools @vinceAmstoutz
98. Pros Cons Finds logic-level flaws that Cannot guarantee 100% traditional tools structurally exploitability verification miss Dual-agent verification reduces false positives Provider-agnostic Low cost compared to manual pentesting or commercial DAST tools @vinceAmstoutz
99. Pros Cons Finds logic-level flaws that Cannot guarantee 100% traditional tools structurally exploitability verification miss Dual-agent verification reduces false positives Provider-agnostic Requires sending code to external provider (unless running local models like Ollama) Low cost compared to manual pentesting or commercial DAST tools @vinceAmstoutz
100. Pros Cons Finds logic-level flaws that Cannot guarantee 100% traditional tools structurally exploitability verification miss Dual-agent verification reduces false positives Requires sending code to external provider (unless running local models like Provider-agnostic Ollama) Low cost compared to manual High token costs on large pentesting or commercial codebases (mitigated by built- DAST tools in optimizations) @vinceAmstoutz
101. Thanks! Any questions ? vinceAmstoutz https://github.com/sponsors/vinceAmstoutz