writeups.xyz / Securing Developer Tools: A New Supply Chain Attack on PHP

Submitter : c2a

Date: 4 October 2022

Bounty : undisclosed

Vulnerabilities :

• Argument Injection
• RCE
• Supply Chain Attack
• Security Code Review

Programs :

• Packagist

Authors :

• Thomas Chauchefoin (@Swapgs)

Link :
https://blog.sonarsource.com/securing-developer-tools-a-new-supply-chain-attack-on-php/