Back Securityaffairs.Co

PHP Composer flaws enable remote command execution via Perforce VCS

Securityaffairs.Co •Pierluigi Paganini • April 15, 2026

Two high-severity flaws in PHP Composer could let attackers run arbitrary commands via malicious repository configs and crafted inputs affecting Perforce VCS. Two high-severity vulnerabilities in PHP Composer could allow attackers to execute arbitrary commands. PHP Composer is a dependency manager for PHP that helps developers install and manage libraries their projects need. By defining […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Composer Vulnerabilities Allow Remote Command Execution Two high-severity vulnerabilities in PHP Composer, a dependency manager for PHP, have been identified, allowing attackers to execute arbitrary commands. These flaws can be exploited through malicious repository configurations and crafted inputs, particularly affecting Perforce VCS. The vulnerabilities pose a significant risk to developers using PHP Composer to manage their project libraries. The exact CVEs for these vulnerabilities have not been disclosed yet. The vulnerabilities are categorized as high-severity due to their potential for remote command execution. Organizations using PHP Composer are advised to review their configurations and inputs to mitigate risks. The current status of these vulnerabilities is under investigation, with no patches mentioned as of now. 3 sources 65

PHP Composer flaws enable remote command execution via Perforce VCS

The full story

Extracted Entities

Attack Types (1)

Platforms (2)