Security

open_basedir

A PHP configuration directive that confines all filesystem access, including include and require, to a named directory tree. Set to the application's own paths, it blocks a file-inclusion bug from reaching gadgets or writable directories elsewhere on the server, breaking the escalation to code execution.

Deep dive

Learn Article

How to Harden PHP So a File-Inclusion Bug Cannot Reach Code Execution

A file-inclusion bug becomes RCE only when the runtime hands it a gadget and a writable path. A layered set of PHP controls that break that chain, ordered by leverage, so a missed patch survives.

intermediate 4 min read

Back to glossary