Packagist Warns: Update Composer Now After GitHub Actions Token Leak

Gbhackers •Mayura Kathir • May 14, 2026

A sudden change in GitHub’s token format has triggered an unexpected security vulnerability in Composer, exposing sensitive authentication tokens in CI/CD logs and forcing Packagist to issue an urgent warning to PHP developers worldwide. The issue stems from a mismatch between GitHub’s updated token structure and Composer’s outdated validation logic. As a result, certain GitHub […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Packagist Issues Urgent Update After GitHub Actions Token Leak A recent change in GitHub's token format has led to a security vulnerability in Composer, exposing sensitive GitHub authentication tokens in CI/CD logs. This flaw affects PHP developers globally, as the outdated validation logic in Composer failed to handle the new token structure. Packagist has issued an urgent warning for developers to update Composer to mitigate the risk of credential exposure. The leak has raised significant concerns about potential unauthorized access to thousands of active software projects. The issue was triggered when GitHub began rolling out the updated token format, which was not compatible with Composer's existing mechanisms. Developers are advised to take immediate action to secure their projects. The scope of the impact is extensive, affecting many projects that utilize Composer for dependency management. 2 sources 69

Extracted Entities

Packagist Warns: Update Composer Now After GitHub Actions Token Leak

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (2)

Tools (1)