A vulnerability was found on the PHP Composer.

A vulnerability was found on the PHP Composer that allows hackers to fire codes at the system without permission.

The PHP language may be a familiar language among website creators and developers, and because it is strongly associated with websites and networks, when a security vulnerability is detected within any part involved, it becomes a big deal.

According to a report by The Hacker News website, a security vulnerability has been detected within PHP Composer, a package manager. The vulnerability will result in hackers being able to execute unauthorized code (Arbitrary Code Execution). There are two security vulnerabilities:

CVE-2026-40176 (CVSS Score: 7.8) is a vulnerability caused by a malfunction in the Improper Input Validation section, allowing hackers to take over the settings of the Repository Configuration in the .json file for use with the Composer that hackers created specifically for this purpose. This will lead to the use of the Perforce VCS Repository to launch commands.

CVE-2026-40261 (CVSS score: 8.8) is another vulnerability caused by untidiness in the Improper Input Validation area. This vulnerability is caused by "Inadequate Escaping" that allows hackers to fire commands through a source source containing Shell Metacharacters, which is specifically created for this purpose.

These two vulnerabilities allow hackers to fire commands on victims even if no Perforce VCS is installed. These two vulnerabilities are on the following PHP Composer.

Version 2.3 or lower, version below 2.9.6 (revised in version 2.9.6 is already available)

Version 2.0 or below, version below 2.2.27 (modified in version 2.2.27 is done)

The source recommends that those using the PHP Composer upgrade to a looped version immediately. The source has verified that the loophole has not been exploited by any hacker group at this time. Therefore, the user is asked to expedite the update. If the upgrade is not possible, the source recommends following instructions to avoid possible attacks.

Check the .json file and check every Perforce-related value before running such file.

Download and use PHP Composer Repository from a trusted source every time.

Avoid using "-prefer-dist" or "preferred-install: dist" settings in the PHP Composer Dependency installation.

# Programming # Trending # Lemon 8 Howtoo # lemon 8 diary # php