PHP Composer Security Update – 16 April 2026

By /
  • 93/2026
  • High

PHP Composer has released a security update to address multiple vulnerabilities affecting Composer versions from 1.0 through 2.2.26 and 2.3 through 2.9.5 (all platforms).

The addressed vulnerabilities could allow the attacker to execute arbitrary commands via improperly escaped shell parameters, gain access to the host system, and perform unauthorized actions with the privileges of the user running the application.

Sample of the addressed vulnerabilities:

PHP Composer Command injection via malicious Perforce Vulnerability (CVE- 2026-40261):

  • CVSS: 8.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Consequences: Gain Access
Vulnerabilities
  • CVE-2026-40261
  • CVE-2026-40176
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

PHP Composer Security Advisory

References

PHP Composer Security Advisory