Multiple PHPUnit Versions Face Arbitrary Code Execution Risks

Multiple PHPUnit Versions Face Arbitrary Code Execution Risks

First seen 5 Feb 2026, 11:54 UTC Linuxsecurity 18.3

Article Content

Browse articles
ThreatCluster

Recent updates to PHPUnit versions 10, 11, and 12 address vulnerabilities related to Poisoned Pipeline Execution (PPE) attacks. Affected users are those utilizing these versions in their PHP applications. The updates were released on January 27, 2026, to prevent execution risks associated with prepared .coverage files in pull requests.