New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released
2026-04-15T01:24:09Z•ffb6c4d2f9d0851952c210413babe0e4ebaa215eb2e62ff4759c829591b42c35
ad-fraud','seo','scareware','glassworm','ide-infection','rust','adobe-acrobatandroidandroid-ratbackdoorchrome-extensionscisacommand-injectioncomposercpuidengagelabfortinetkevmalicious-extensionsmarimomiraxperforcephprcesdk-vulnerabilityshowdocsmart-slidersql-injectionstx-ratsupply-chain
What happened
A batch of high-impact security incidents and disclosures affecting open-source tooling, commercial products and supply chains. Key issues include newly disclosed Composer command-injection vulnerabilities (notably CVE-2026-40176) enabling arbitrary command execution in the Perforce VCS driver (patches released); multiple actively exploited RCEs such as ShowDoc CVE-2025-0520, Adobe Acrobat CVE-2026-34621, and Marimo CVE-2026-39987; CISA additions to the KEV list including CVE-2026-21643 (Fortinet FortiClient EMS SQLi); and several supply-chain and distribution compromises (CPUID trojanized CPU
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- ffb6c4d2f9d0851952c210413babe0e4ebaa215eb2e62ff4759c829591b42c35
- Enrichment time
- 2026-04-15T01:24:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.