Hackers Compromise Laravel

Gbhackers •Eswar • May 23, 2026

A sophisticated and active supply chain attack has struck the Laravel-Lang open-source organization, compromising over 700 historical package versions across four widely used PHP localization repositories. The attack, detected on May 22, 2026, and reported by both Aikido Security and the Socket Research Team, introduces a fully functional remote code execution (RCE) backdoor that executes automatically via Composer’s […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack Compromises Laravel Lang Packages with Credential Stealer On May 22, 2026, a supply chain attack targeted Laravel Lang localization packages, compromising 233 versions across four repositories. Attackers exploited GitHub's version tagging system to redirect legitimate tags to malicious commits in a controlled fork. This allowed the injection of a credential-stealing malware via Composer's autoloader. The malware, which is capable of harvesting various sensitive data including cloud credentials and SSH keys, was delivered through a file named 'src/helpers.php'. Security firms Aikido and Socket confirmed the attack and reported it to GitHub and Packagist, leading to the removal of the malicious versions. The attack affects developers using the Laravel ecosystem, posing a significant risk to their environments. Current remediation efforts are in place to prevent further installations of the compromised packages. 12 sources 71

Extracted Entities

Hackers Compromise Laravel

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)