Composer 2.11 can delay compromised package releases — and urgent security fixes
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Search
Search results for “Composer security”
Find published research by company, product, platform or technology.
Showing 1–20 of 236 dossiers
Laravel Vet puts a trust gate in front of Composer dependency updates
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
Pollora puts WordPress inside Laravel — a PHP-first path with a two-framework maintenance cost
Pollora changes the WordPress build workflow for Laravel teams, but developers must accept PHP 8.4 requirements, dual boot costs and compatibility testing.
tinyjs keeps tightening desktop-runtime security, now blocking remote shell-opening and unsafe app updates
tinyjs 0.63.0 closes another dangerous wrapper boundary: a remote site could previously launch downloaded local programs. Signed updates and platform-target checks add further defence, but operators need to enable signing themselves.
psqlODBC 18.00.0006 patches 11 security flaws across PostgreSQL ODBC clients
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
Gitea 28.3 fixes OAuth account takeover and Actions secret-exposure flaws across 20 security issues
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
pgAdmin 4 9.19 patches 15 security flaws — server operators must check a one-time command migration
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Firefox plans to stagger security fixes so AI attackers cannot combine unpatched browser bugs
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP Mobile patches seven security flaws — rebuilding and app-store releases are required
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Coolify rushes security fixes to all v4 lines after PHP2Shell and dependency vulnerabilities
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
Node.js fixes Brotli code-execution risk and TLS hostname bypasses in October security release
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
PHP security release fixes an IPv6 FastCGI ACL bypass across every supported branch
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
OpenVPN 2.7.7 fixes a control-channel DoS and multiple Windows security flaws
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
AWS Security Agent can now hard-cap autonomous pentest spend and revalidate individual fixes
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
Node.js July security release fixes high-severity HTTP/2 and Permission Model flaws
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
FrankenPHP 1.13.5 patches 17 flaws, including uploaded-file PHP execution
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
zlib 1.4 fixes multiple memory-safety flaws — and changes Windows build compatibility
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
Caddy 2.11.9 fixes PHP directory regressions and FastCGI security bypasses
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
Northflank warns all customers to rotate secrets after AI keys were abused in October breach
No workload-data access observed, Northflank says, but independent forensics continue and the secret-rotation warning remains.