--- title: Unverified | daily.dev description: Composer now blocks installing known-vulnerable or malicious package versions by default, Sebastian Bergmann explains in an interview. Since Composer 2.9,... canonical: https://daily.dev/posts/unverified-tiojtlabj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unverified | daily.dev og:description: Composer now blocks installing known-vulnerable or malicious package versions by default, Sebastian Bergmann explains in an interview. Since Composer 2.9,... og:url: https://daily.dev/posts/unverified-tiojtlabj og:image: https://api.daily.dev/og/posts/TiOjtLABj.png og:image:alt: Unverified og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unverified **[PHPUnit Expert](https://daily.dev/sources/phpunit-expert)** · 14 min read · 0 upvotes · 0 comments ## Summary Composer now blocks installing known-vulnerable or malicious package versions by default, Sebastian Bergmann explains in an interview. Since Composer 2.9, composer update refuses advisory-flagged versions within minutes of publication, and since Composer 2.10 malware-flagged versions are also blocked during composer install. He warns that composer install from a lock file is not protected by advisory checks, so teams should run composer audit on a schedule. The interview also covers PHP2Shell, two PHP runtime CVEs (CVE-2026-109618 and CVE-2026-109619) exploitable via mod_php before any application code runs, and why LLM-generated code and tests need independent verification such as mutation testing with Infection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does composer install check for security advisories the same way composer update does? No. Composer only blocks known-vulnerable package versions during dependency resolution, meaning composer update, composer require, and composer remove, but not during composer install from an existing lock file. The exception is malware-flagged versions, which since Composer 2.10 are also blocked during composer install. Running composer audit on a schedule in CI catches advisories published after a project last resolved its dependencies. _Teams rethinking their CI security checks can track Composer and dependency-audit changes like these on daily.dev._ ### What were the CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP2Shell and did they require authentication to exploit? CVE-2026-109618 and CVE-2026-109619 are vulnerabilities in the PHP runtime itself, not in application dependencies. With mod_php, an unauthenticated request could trigger the exploit before any application code ran, meaning nothing in an application's code, its dependencies, or Composer configuration could have prevented it. The PHP security team made an exception and backported minimal source fixes to PHP 7.4, 8.0, and 8.1. _Developers auditing runtime exposure after incidents like PHP2Shell can follow the fix details on daily.dev._ ### Why isn't high code coverage enough to trust that generated tests actually verify correct behavior? Code coverage only shows which code ran during testing, not which code was actually verified for correctness. Tests generated alongside LLM-produced code confirm what the code does, not what it was meant to do, so a test suite derived from the same implementation can't catch its own errors. Mutation testing tools like Infection expose this gap by altering code (e.g. swapping '<' for '<=') and checking whether tests notice. _Developers evaluating AI-generated test suites can dig into mutation testing tools like Infection on daily.dev._ ## Similar posts on daily.dev - [Malware Blocking and Dependency Policies in Composer 2.10](https://daily.dev/posts/malware-blocking-and-dependency-policies-in-composer-2-10-dqtvhtqmx) · Laravel News · 0 upvotes · 0 comments - [The Bouncer in the Dependency Resolver](https://daily.dev/posts/the-bouncer-in-the-dependency-resolver-bfy1gkze0) · PHPUnit Expert · 1 upvotes · 0 comments - [Packagist is now protected by Aikido Intel and other updates to the PHP registry](https://daily.dev/posts/packagist-is-now-protected-by-aikido-intel-and-other-updates-to-the-php-registry-meri1hnqn) · Aikido Security · 0 upvotes · 0 comments - [Composer's dependency policies](https://daily.dev/posts/composer-s-dependency-policies-ynq88kd1g) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#mutation-testing](https://daily.dev/tags/mutation-testing) [View this post on daily.dev](https://daily.dev/posts/unverified-tiojtlabj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unverified","url":"https://daily.dev/posts/unverified-tiojtlabj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unverified-tiojtlabj"},"datePublished":"2026-10-29T20:07:30.377Z","dateModified":"2026-10-29T20:08:27.684Z","description":"Composer now blocks installing known-vulnerable or malicious package versions by default, Sebastian Bergmann explains in an interview. Since Composer 2.9,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a27879f0f8a05514034080e53909f224?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a27879f0f8a05514034080e53909f224?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"PHPUnit Expert","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"PHPUnit Expert","logo":"https://media.daily.dev/image/upload/s--FMZoysoG--/f_auto,q_auto/v1774964057/logos/phpunit-expert?_a=BAMAMiWQ0","url":"https://daily.dev/sources/phpunit-expert"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unverified-tiojtlabj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,mutation-testing","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHPUnit Expert","item":"https://daily.dev/sources/phpunit-expert"},{"@type":"ListItem","position":3,"name":"Unverified"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/unverified-tiojtlabj#faq","mainEntity":[{"@type":"Question","name":"Does composer install check for security advisories the same way composer update does?","acceptedAnswer":{"@type":"Answer","text":"No. Composer only blocks known-vulnerable package versions during dependency resolution, meaning composer update, composer require, and composer remove, but not during composer install from an existing lock file. The exception is malware-flagged versions, which since Composer 2.10 are also blocked during composer install. Running composer audit on a schedule in CI catches advisories published after a project last resolved its dependencies. Teams rethinking their CI security checks can track Composer and dependency-audit changes like these on daily.dev."}},{"@type":"Question","name":"What were the CVE-2026-109618 and CVE-2026-109619 vulnerabilities in PHP2Shell and did they require authentication to exploit?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-109618 and CVE-2026-109619 are vulnerabilities in the PHP runtime itself, not in application dependencies. With mod_php, an unauthenticated request could trigger the exploit before any application code ran, meaning nothing in an application's code, its dependencies, or Composer configuration could have prevented it. The PHP security team made an exception and backported minimal source fixes to PHP 7.4, 8.0, and 8.1. Developers auditing runtime exposure after incidents like PHP2Shell can follow the fix details on daily.dev."}},{"@type":"Question","name":"Why isn't high code coverage enough to trust that generated tests actually verify correct behavior?","acceptedAnswer":{"@type":"Answer","text":"Code coverage only shows which code ran during testing, not which code was actually verified for correctness. Tests generated alongside LLM-produced code confirm what the code does, not what it was meant to do, so a test suite derived from the same implementation can't catch its own errors. Mutation testing tools like Infection expose this gap by altering code (e.g. swapping '\u003c' for '\u003c=') and checking whether tests notice. Developers evaluating AI-generated test suites can dig into mutation testing tools like Infection on daily.dev."}}]} ```