PatchClock

PHP security digest · 28 Sep to 4 Oct 2026

6 new advisories for Composer packages

This week’s six advisories include two high-severity issues: denial of service in league/commonmark’s GitHub Flavored Markdown Table extension and remote code execution via eval() in phpcsstandards/phpcsutils. Update league/commonmark to 2.10.2, which also fixes a DisallowedRawHtml bypass, and phpcsstandards/phpcsutils to 1.2.3. Update composer/composer to 2.10.3 or 2.2.30 for a fix bypass involving a symlinked package bin path. The remaining fixes are league/flysystem 3.35.3 for a malformed UTF-8 path-check bypass affecting every adapter, and laravel/framework 12.69.0 or 13.30.0 for XSS in Debug Page Information.

  1. High league/commonmark 499M installs

    league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

    Fixed in 2.10.2 · CVE-2026-105830

  2. High phpcsstandards/phpcsutils 53M installs

    PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

    Fixed in 1.2.3 · CVE-2026-65954

  3. Medium league/commonmark 499M installs

    league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

    Fixed in 2.10.2 · CVE-2026-105829

  4. Medium composer/composer 211M installs

    Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

    Fixed in 2.10.3, 2.2.30 · CVE-2026-59944

  5. Low league/flysystem 748M installs

    Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

    Fixed in 3.35.3 · CVE-2026-102601

  6. Low laravel/framework 603M installs

    Laravel: XSS in Debug Page Information

    Fixed in 12.69.0, 13.30.0 · CVE-2026-102279

Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.