New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released
2026-04-14T19:24:11Z•6d411d4290af08e9ea0df69a561d1ad5572ea7fe4c43934e24320cc76585d024
adobeandroidchrome-extensionscisacommand-injectioncomposermalwaremarimoperforcephpremote-code-executionsecurity-newsshowdocsupply-chainvulnerabilities
What happened
A roundup of active security incidents and patches: Two high-severity command-injection flaws in PHP Composer's Perforce VCS driver were disclosed and patched (noted CVE-2026-40176). Multiple other high-impact issues are reported or actively exploited — ShowDoc RCE (CVE-2025-0520) under active exploitation, a Fortinet FortiClient EMS SQLi added to CISA KEV (CVE-2026-21643), an actively exploited Acrobat Reader flaw (CVE-2026-34621) patched by Adobe, and a Marimo pre-auth RCE (CVE-2026-39987) exploited within hours of disclosure. The feed also highlights widespread supply-chain and distribution
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 6d411d4290af08e9ea0df69a561d1ad5572ea7fe4c43934e24320cc76585d024
- Enrichment time
- 2026-04-14T19:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.