Composer Archives • Daily CyberSecurity

Composer 2.11.2 and 2.2.32 Fix Command Execution, File Write and Credential Leak Flaws

Composer vulnerabilities fixed in 2.11.2 including composer.lock command execution flaw

Composer 2.11.2 and 2.2.32 Fix Command Execution, File Write and Credential Leak Flaws

Do Son November 10, 2026

Composer 2.11.2 and 2.2.32 fix three Composer vulnerabilities, including command execution via a crafted composer.lock file (CVSS 8.8).

Composer 2.11.0 and 2.2.31 Patch Path Traversal and Token Leak Vulnerabilities Composer vulnerabilities diagram showing Composer 2.11.0 fixes for GHSA-c968-33g3-wh7p and GHSA-fm2w-xgf2-f9fh

Composer vulnerabilities diagram showing Composer 2.11.0 fixes for GHSA-c968-33g3-wh7p and GHSA-fm2w-xgf2-f9fh

Composer 2.11.0 and 2.2.31 Patch Path Traversal and Token Leak Vulnerabilities

Do Son October 30, 2026

Upgrade to Composer 2.11.0 or 2.2.31 to fix two Composer vulnerabilities: path traversal GHSA-c968-33g3-wh7p and token leak GHSA-fm2w-xgf2-f9fh.

High-Severity Composer Flaw Enables Command Execution Composer vulnerability arbitrary command execution warning for PHP dependency manager

Composer vulnerability arbitrary command execution warning for PHP dependency manager

High-Severity Composer Flaw Enables Command Execution

Do Son August 31, 2026

Two Composer vulnerabilities, including CVE-2026-59944, allow directory escape and arbitrary command execution. Update to 2.10.3 or 2.2.30 now.

Urgent Update: Composer Vulnerability Leaks GitHub Secrets in Plaintext Logs (CVE-2026-45793) CVE-2026-40176, CVE-2026-40261 Composer GitHub Token Leak CVE-2026-45793

CVE-2026-40176, CVE-2026-40261 Composer GitHub Token Leak CVE-2026-45793

Urgent Update: Composer Vulnerability Leaks GitHub Secrets in Plaintext Logs (CVE-2026-45793)

Do Son May 14, 2026

Composer CVE-2026-45793 leaks GitHub tokens into CI/CD logs due to a validation error. Update to version 2.9.8 now and audit your GitHub Action logs.

Supply Chain Sabotage: The Critical RCE Flaws Lurking in PHP Composer CVE-2026-40176, CVE-2026-40261 Composer GitHub Token Leak CVE-2026-45793

Supply Chain Sabotage: The Critical RCE Flaws Lurking in PHP Composer

Do Son April 14, 2026

Critical Remote Command Injection flaws in PHP Composer's Perforce integration (CVE-2026-40176 & CVE-2026-40261) could lead to full system compromise. Patch now.

Critical Security Flaws Discovered in Popular PHP Package Manager CVE-2024-35241 & CVE-2024-35242

Critical Security Flaws Discovered in Popular PHP Package Manager

Do Son June 11, 2024

CVE-2024-35241 and CVE-2024-35242, both involve command injection attacks through malicious git/hg branch names

CVE-2024-24821: A Critical Alert for Composer’s PHP Dependency Management

Do Son February 8, 2024

CVE-2024-24821 casts a shadow over Composer's reliability, exposing users to potential code execution and privilege escalation threats