Packagist Conductors’ Post

𝗛𝗶𝗴𝗵 𝗔𝗹𝗲𝗿𝘁 🚨 𝗜𝗳 𝘆𝗼𝘂𝗿 𝗽𝗿𝗼𝗷𝗲𝗰𝘁(𝘀) 𝗮𝗿𝗲 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝗼𝗻 𝗖𝗼𝗺𝗽𝗼𝘀𝗲𝗿 𝗯𝗲𝗹𝗼𝘄 𝟮.𝟵.𝟲 𝗼𝗿 𝟮.𝟮.𝟮𝟳 𝗟𝗧𝗦 — 𝘀𝘁𝗼𝗽 𝗮𝗻𝗱 𝗿𝗲𝗮𝗱 𝘁𝗵𝗶𝘀. Packagist just disclosed two command injection vulnerabilities (CVE-2026-40261 & CVE-2026-40176) in Composer's Perforce driver. What that means in plain terms: A bad package from a compromised repository can silently run commands on your server — no extra steps required from your team. These things rarely make it to anyone's radar — until it's too late. The fix is one command: 𝗰𝗼𝗺𝗽𝗼𝘀𝗲𝗿 𝘀𝗲𝗹𝗳-𝘂𝗽𝗱𝗮𝘁𝗲 𝟮.𝟵.𝟲 Staying ahead of this is part of what I do for the systems I work on. Sharing the original Packagist advisory below. 👇 https://lnkd.in/dDeZzjCt #Laravel #PHP #SaaS #WebSecurity #SystemArchitecture

⚠️ Update Composer Now: 2 High-Severity CVEs Disclosed CVE-2026-40176 (7.8) & CVE-2026-40261 (8.8) in Composer allow command injection via Perforce VCS driver... even if Perforce isn't installed. ✅ Fix: Update to 2.9.6+ or 2.2.27+ ✅ Run: composer self-update ✅ Audit: Check composer.json for untrusted Perforce configs No active exploits found on Packagist, but patch immediately. #PHP #Composer #Security #QadrLabs

A critical remote code execution vulnerability in ShowDoc, tracked as CVE-2025-0520 with a CVSS score of 9.4, is under active exploitation. The flaw affects ShowDoc versions prior to 2.8.7 and allows attackers with low-level access to upload arbitrary PHP files and execute code on the server. Read more in our news update over on our blog: https://bit.ly/48yb68s

DDLess v5.0.0 is out and there's not a single new feature in it. No new buttons. No new panels. No new integrations. Just dozens of things that used to be annoying and now aren't. Chrome remembers your logins between debug sessions. Pressing Back stops the listener automatically. The tour tooltips can be dragged when they block your view. SSH uploads happen in the background. The proxy is always on one less checkbox to think about. This is the version where DDLess stopped growing and started maturing. Sometimes the best release is the one where everything just works a little better than before. https://ddless.com #php #debugging #devtools #dx #laravel #symfony #cakephp #yii

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.

Fake Laravel packages on Packagist are installing backdoors. Not theoretical. Happening right now. They typosquat real package names, one character off. The install instructions look identical. The README is copied. But the code includes a remote access trojan that phones home on every request. One had 300+ installs before it was flagged. Here's how to check your composer.lock and what to do if you find something. Swipe through for the full investigation. #laravelsecurity #phpsecurity #supplychain #webdev #composerphp

Two critical command-injection flaws found in PHP Composer’s Perforce VCS driver (CVE-2026-40176, CVE-2026-40261) allow arbitrary code execution even without Perforce installed. Patches released in 2.9.6 & 2.2.27. #PHPComposer #CodeSecurity #USA ➡️ https://ift.tt/bjAh18O

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

How a URL Turns Into a Web Page (In 11 Simple Steps) Ever wondered what happens after you type a URL and hit Enter? It’s not magic; it’s a well organized process involving your browser, network, and server. #WebDevelopment #FrontendDevelopment #BackendDevelopment #FullStackDeveloper #SoftwareEngineering #DNS #HTTP #HTTPS #TCPIP #WebArchitecture #APIs #JavaScript #WebPerformance

The Mini Shai-Hulud campaign has reached Packagist. intercom/intercom-php@5.0.2 was compromised with the same payload seen in today's npm and PyPI attacks. Because Packagist mirrors tags from upstream Git repositories, and Git tags can be force-updated to point to a different commit, meaning the attacker overwrote the existing version. And on top that rather than an npm-style preinstall hook, the PHP artifact registers itself as a Composer plugin and subscribes to post-install-cmd and post-update-cmd events (and then downloads the same Bun payload).