From the GNUCitizen blog, there's a new post about a recent meeting (of the OWASP London Chapter) where several presentations were given on methods for exploiting PHP applications. The three talks given were:

• Rodrigo Marcos - hacking PHP sockets for fun and profit
• David Kierznowski - exploitation techniques using real world examples
• Colin Watson - talk about security badges

There's links to the slides for one the formal presentations, the exploitation techniques - two sets: the remote exploit examples and local exploit examples.

Michael Ross has written up (and gotten posted to Slashdot) a review of a book from APress "Practical Web 2.0 Applications with PHP":

Because learning and using most of these technologies can be rather challenging to a Web developer, perhaps the best way to get started doing so is by using all of them to create a single Web-based application, with no pretense at mastering any one of them. This is the approach taken in Quentin Zervaas's book, Practical Web 2.0 Applications with PHP."

The book (see its web page here) covers lots of different technologies and seeks to be pretty comprehensive and, at around 570 pages, crams as much between its covers as it can. He goes through some parts of the book specifically but glosses over some for the sake of the length of the review.