Most PHP security incidents don’t start with sophisticated exploits. They start with something ordinary: a new endpoint that trusts input too much, a template that renders unescaped content, a long-lived token that silently overreaches, or an image that ships with yesterday’s CVEs.