New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released

Two high-severity command injection vulnerabilities in Composer's Perforce VCS driver could allow arbitrary command execution. Patches have been released to address these flaws, which are tracked as CVE-2026-40176 and another unspecified CVE.