Project
The main public package repository for PHP, from which Composer resolves and installs libraries and command-line tools.
Unit 42 says supply-chain attackers have moved command-and-control into blockchain smart contracts, so one transaction can re-point an entire botnet or worm. Defenders' useful choke points are now developer machines, CI runners and the chain lookup itself.
Reality
Bitbucket Cloud's API tokens, which replace app passwords removed on 28 July 2026, expire after one year with no extension, a dev.to migration guide says. Teams that switch in July 2026 have set their next credential failure for July 2027 unless someone owns token rotation.
Reality
Socket reports no malicious stable release. The exposure sits with teams that resolve dev-* constraints directly, and with anyone who clones the repository and opens it in a VS Code-compatible IDE.
Reality
Symfony AI Mate deleted its MCP server in August and now exposes profiler data through console commands that SKILL.md files tell the agent to run. The author of the community bundle Mate replaced has deprecated his.
Reality
The rewritten PHP copy/paste detector reached Packagist on September 13, and the script in its release gate reads the header of every file in src/ and exits non-zero while one copyright holder is still inherited.
Reality
A table widget returned 17 lines into a ten-row terminal and no test complained, because every render test handed it a context with seven rows of slack and then asserted the line count its author already expected.
Reality
Socket says trojanized OphimCMS and KKPhim themes chain two WebKit bugs to an IOKit kernel escape on visitors' iPhones, turning a Composer dependency problem into wallet seed theft from people who only loaded a page.
Reality
Socket found thirteen trojanized Composer themes across five vendor namespaces, and the front-end assets those packages ship carry an iPhone exploit chain out to the mobile visitors of every site that installs one.
Reality
A dev.to walkthrough puts the laravel-lang tag rewrite at 90 minutes and 5,561 poisoned repositories in six hours. The caret range in your composer.json never got a vote.
Reality