Code Reuse Attacks in PHP: Automated POP Chain Generation. - Johannes Dahse; Nikolai Krein; Thorsten Holz (CCS, 2014)

Simulation of Built-in PHP Features for Precise Static Code Analysis. - Johannes Dahse; Thorsten Holz (NDSS, 2014)

Static Detection of Second-Order Vulnerabilities in Web Applications. - Johannes Dahse; Thorsten Holz (USENIX Security Symposium, 2014)

Experience report: an empirical study of PHP security mechanism usage. - Johannes Dahse; Thorsten Holz (ISSTA, 2015)

Security Analysis of PHP Bytecode Protection Mechanisms. - Dario Weißer; Johannes Dahse; Thorsten Holz (RAID, 2015)

No Honor Among Thieves: A Large-Scale Analysis of Malicious Web Shells. - Oleksii Starov; Johannes Dahse; Syed Sharique Ahmad; Thorsten Holz; Nick Nikiforakis (WWW, 2016)

Static detection of complex vulnerabilities in modern PHP applications. - Johannes Dahse (2016)