Slevomat Coding Standard for PHP_CodeSniffer provides many useful sniffs

FUGIO: Automatic Exploit Generation for PHP Object Injection Vulnerabilities

Parser utility to generate ASTs from PHP source code suitable to be processed by Joern.

Backports unserialize options introduced in PHP 7.0 to older PHP versions.

Tool to infer param- and return types and declare them as return type declarations and type hints.