--- title: PHPUnit: A Security Risk? | daily.dev description: Sebastian Bergmann, the creator of PHPUnit, recounts the story of CVE-2017-9841 — a remote code execution vulnerability caused by the file eval-stdin.php being... canonical: https://daily.dev/posts/phpunit-a-security-risk--9dioa1hig twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHPUnit: A Security Risk? | daily.dev og:description: Sebastian Bergmann, the creator of PHPUnit, recounts the story of CVE-2017-9841 — a remote code execution vulnerability caused by the file eval-stdin.php being... og:url: https://daily.dev/posts/phpunit-a-security-risk--9dioa1hig og:image: https://api.daily.dev/og/posts/9DiOa1HiG.png og:image:alt: PHPUnit: A Security Risk? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHPUnit: A Security Risk? **[PHPUnit Expert](https://daily.dev/sources/phpunit-expert)** · 7 min read · 0 upvotes · 0 comments ## Summary Sebastian Bergmann, the creator of PHPUnit, recounts the story of CVE-2017-9841 — a remote code execution vulnerability caused by the file eval-stdin.php being included in PHPUnit and inadvertently deployed to public web servers via e-commerce platforms like WooCommerce and PrestaShop. The file, originally designed for CLI use only, could be exploited via HTTP POST requests when publicly accessible. Bergmann explains the history of the file, how the vulnerability works, and the eventual fix: removing eval-stdin.php entirely from PHPUnit 7.5.20 and 8.5.2 in January 2020. The key takeaway is that the vendor directory managed by Composer should never be publicly accessible, and dev-only dependencies like PHPUnit must not be deployed to production. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Test-Driven Security](https://daily.dev/posts/test-driven-security-rqc3xemtd) · PHPUnit Expert · 2 upvotes · 0 comments - [When static analysis runs your code](https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u) · PHPUnit Expert · 1 upvotes · 0 comments --- Tags: [#php](https://daily.dev/tags/php), [#phpunit](https://daily.dev/tags/phpunit) [View this post on daily.dev](https://daily.dev/posts/phpunit-a-security-risk--9dioa1hig) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHPUnit: A Security Risk?","url":"https://daily.dev/posts/phpunit-a-security-risk--9dioa1hig","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/phpunit-a-security-risk--9dioa1hig"},"datePublished":"2026-03-31T13:34:22.963Z","dateModified":"2026-03-31T13:35:46.015Z","description":"Sebastian Bergmann, the creator of PHPUnit, recounts the story of CVE-2017-9841 — a remote code execution vulnerability caused by the file eval-stdin.php being...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9afbb73e6faa5eb8f302e28eea44e669?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9afbb73e6faa5eb8f302e28eea44e669?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"PHPUnit Expert","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"PHPUnit Expert","logo":"https://media.daily.dev/image/upload/s--FMZoysoG--/f_auto,q_auto/v1774964057/logos/phpunit-expert?_a=BAMAMiWQ0","url":"https://daily.dev/sources/phpunit-expert"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/phpunit-a-security-risk--9dioa1hig","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,phpunit","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHPUnit Expert","item":"https://daily.dev/sources/phpunit-expert"},{"@type":"ListItem","position":3,"name":"PHPUnit: A Security Risk?"}]} ```