Hackers Compromised 233 Versions of Laravel

Cybersecuritynews •Guru Baran • May 23, 2026

A highly sophisticated supply chain attack has compromised the Laravel-Lang ecosystem, injecting credential-stealing remote code execution backdoors into 233 package versions across 700 GitHub repositories. Discovered in May 2026 by Socket and Aikido, threat actors manipulated GitHub tags to distribute malware through Composer’s autoloader, granting complete remote access to developer environments. The attackers bypassed direct […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack Compromises Laravel Lang Packages with Credential Stealer On May 22, 2026, a supply chain attack targeted Laravel Lang localization packages, compromising 233 versions across four repositories. Attackers exploited GitHub's version tagging system to redirect legitimate tags to malicious commits in a controlled fork. This allowed the injection of a credential-stealing malware via Composer's autoloader. The malware, which is capable of harvesting various sensitive data including cloud credentials and SSH keys, was delivered through a file named 'src/helpers.php'. Security firms Aikido and Socket confirmed the attack and reported it to GitHub and Packagist, leading to the removal of the malicious versions. The attack affects developers using the Laravel ecosystem, posing a significant risk to their environments. Current remediation efforts are in place to prevent further installations of the compromised packages. 12 sources 71

Extracted Entities

Hackers Compromised 233 Versions of Laravel

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)