Skip to main content

composer

Browse all articles, tutorials, and guides about composer

1posts

Posts

Security
2026-04-14|6 min read

Two Composer Command Injection Flaws Let Attackers Run Arbitrary Code - Even Without Perforce

CVE-2026-40176 and CVE-2026-40261 affect all Composer 2.x versions. A malicious composer.json or crafted package metadata can execute OS commands on your machine. Upgrade to 2.9.6 now.