High-Severity PHPUnit Vulnerability Enables Remote Code Execution

A critical argument-injection vulnerability in PHPUnit (CVE-2026-41570, CVSS 7.8) allows newline injection in INI values forwarded to child processes, enabling immediate remote code execution (RCE) when CI/build runners execute untrusted test configurations. The realistic attack vector—Poisoned Pipeline Execution—occurs when an attacker submits a malicious pull request that modifies phpunit.xml; the report describes vendor fixes (rejecting line breaks and quoting metacharacters) and recommends urgent upgrades, auditing phpunit.xml entries, containerized ephemeral CI runners, and requiring human review for forked PRs.