New PHP Composer Vulnerability Let Attackers Execute Arbitrary Commands

PHP Composer released urgent updates for two critical command-injection vulnerabilities in its Perforce VCS handling and source-reference escaping (CVE-2026-40176 and CVE-2026-40261) that can enable arbitrary command execution via malicious composer.json or package metadata; users should upgrade to Composer 2.9.6 or 2.2.27 and apply recommended mitigations (prefer-dist, inspect composer.json, use trusted repositories); Packagist has disabled Perforce source metadata and scans found no evidence of exploitation prior to disclosure.