[sarciszewski]

We have a curated list here, which has all you want to know and then some:

https://github.com/paragonie/awesome-appsec

Our blog also have a bunch of posts about building secure web applications in PHP:

https://paragonie.com/blog/category/security-engineering

I hope either one helps.