New PHP Composer Vulnerability Let Attackers Execute Arbitrary Commands

Cybersecuritynews •Abinaya • April 15, 2026

PHP Composer released urgent security updates to address two critical command injection vulnerabilities. PHP Composer is an essential dependency management tool used globally by developers, making any code execution flaws highly concerning. These specific bugs reside in the Perforce Version Control System (VCS) driver and allow attackers to execute arbitrary commands on a victim’s machine. Users […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Composer Vulnerabilities Allow Remote Command Execution Two high-severity vulnerabilities in PHP Composer, a dependency manager for PHP, have been identified, allowing attackers to execute arbitrary commands. These flaws can be exploited through malicious repository configurations and crafted inputs, particularly affecting Perforce VCS. The vulnerabilities pose a significant risk to developers using PHP Composer to manage their project libraries. The exact CVEs for these vulnerabilities have not been disclosed yet. The vulnerabilities are categorized as high-severity due to their potential for remote command execution. Organizations using PHP Composer are advised to review their configurations and inputs to mitigate risks. The current status of these vulnerabilities is under investigation, with no patches mentioned as of now. 3 sources 65

Extracted Entities

Platforms (2)

Perforce Version Control System (vcs) Driver PHP Composer