{"slug": "php-and-composer-support-is-now-in-beta", "title": "PHP and Composer Support Is Now in Beta", "summary": "Socket has moved its PHP and Composer support from Experimental to Beta, now enabled for all customers, with PHP reachability analysis generally available. The Socket Threat Research team has tracked attacks across the PHP ecosystem, including malicious packages on Packagist and compromised repositories, highlighting the need for comprehensive dependency analysis beyond CVE matching.", "body_md": "# PHP and Composer Support Is Now in Beta\n\nSocket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.\n\n- Trevor Norris\n- Benjamin Barslev\n\nToday, Socket’s PHP and Composer support is moving from Experimental to Beta and is now enabled for all customers. PHP reachability analysis is also generally available, helping teams determine which vulnerabilities in their dependencies can be reached from their application code.\n\nWe [introduced PHP and Composer support](https://socket.dev/blog/introducing-php-and-composer-support) earlier this year with package search, dependency scanning, SBOM generation, CVE detection, and AI-powered analysis for Packagist packages. Moving to Beta makes that protection available across every customer organization without requiring Experimental access.\n\n## Socket Research Has Tracked Attacks Across the PHP Ecosystem[#](#Socket-Research-Has-Tracked-Attacks-Across-the-PHP-Ecosystem)\n\nSince launching PHP support and beginning continuous scanning of Packagist, the Socket Threat Research team has identified malicious packages, compromised repositories, and campaigns moving into PHP from other ecosystems.\n\nIn April, we watched Mini Shai-Hulud jump from npm to Packagist through a [malicious version of Intercom’s PHP package](https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise). The package abused Composer plugin execution to steal cloud and CI/CD credentials.\n\nSocket researchers later found [a malicious postinstall hook across more than 700 GitHub repositories](https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos), including PHP packages distributed through Packagist. We also identified [malicious code in a development version of a legitimate Laravel package](https://socket.dev/blog/famous-chollima-targets-php-developers-through-compromised-packagist-package) linked to Famous Chollima activity. The loader used blockchain infrastructure to retrieve and execute remote code in an apparent developer-targeting campaign.\n\nAttackers have also used familiar PHP tooling as cover. We found [malicious Packagist packages disguised as Laravel utilities](https://socket.dev/blog/malicious-packagist-packages-disguised-as-laravel-utilities) that deployed an encrypted PHP remote access trojan, along with [six packages posing as CMS themes](https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery) that shipped trojanized jQuery to exfiltrate URLs, inject ads, and redirect visitors.\n\nThese incidents show why PHP security requires more than matching package versions against known CVEs. Teams also need visibility into malicious packages, compromised releases, poisoned development branches, and install-time behavior.\n\n## PHP Projects Now Receive Full Dependency Analysis[#](#PHP-Projects-Now-Receive-Full-Dependency-Analysis)\n\nSocket analyzes both `composer.lock`\n\nand `composer.json`\n\nfiles to resolve PHP dependency trees and identify the packages and versions used across a project.\n\nSupport includes:\n\n- SBOM generation for PHP projects, with or without a lockfile\n- Direct and transitive dependency analysis\n- CVE detection across Packagist packages\n- CISA KEV, CWE, and EPSS context for vulnerabilities\n- AI-powered analysis for malicious and suspicious package behavior\n- Separate identification of development dependencies\n- Support for repositories containing multiple Composer projects\n- Supply chain attack campaign tracking\n\nSocket also continuously monitors packages and updates published to Packagist, helping teams identify malicious code before it reaches their projects.\n\n## PHP Reachability Is Now Generally Available[#](#PHP-Reachability-Is-Now-Generally-Available)\n\nFinding a vulnerable package version does not tell you whether an application can invoke the vulnerable code. Reachability analysis examines the functions involved and helps teams separate vulnerabilities that need attention from those that cannot be reached.\n\nSocket now provides two forms of reachability analysis for PHP:\n\n[Precomputed Reachability](https://docs.socket.dev/docs/precomputed-reachability)analyzes function calls within the dependency graph and can flag around 60% of vulnerabilities in transitive dependencies as irrelevant. It works from Composer manifests without requiring access to application source code or additional configuration.[Full Application Reachability](https://docs.socket.dev/docs/full-application-reachability)analyzes both application source code and dependency code, showing whether an application can reach a vulnerable function and the call path that leads to it. This deeper analysis can eliminate up to 90% of false positives.\n\nThe PHP analysis engine accounts for language patterns that make static analysis difficult, including magic method dispatch through `__call`\n\n, dynamically instantiated classes, and string-keyed service containers used by frameworks such as Laravel and Symfony.\n\nCheck out our previous [PHP Reachability technical overview](https://socket.dev/blog/reachability-for-php) for a more comprehensive explanation of the underlying analysis and a walk through of how it would apply to a real Guzzle vulnerability.\n\n## Available Today[#](#Available-Today)\n\nPHP and Composer support is now available in Beta for all Socket customers. PHP reachability analysis is generally available for customers on the [Team plan](https://socket.dev/pricing) tier and higher, and no longer requires Experimental access.", "url": "https://wpnews.pro/news/php-and-composer-support-is-now-in-beta", "canonical_source": "https://socket.dev/blog/php-and-composer-support-now-in-beta?utm_medium=feed", "published_at": "2026-08-21 17:54:18+00:00", "updated_at": "2026-08-21 18:44:02.384375+00:00", "lang": "en", "topics": ["ai-products", "ai-tools"], "entities": ["Socket", "Composer", "Packagist", "PHP", "Socket Threat Research team", "Intercom", "Laravel", "Famous Chollima"], "alternates": {"html": "https://wpnews.pro/news/php-and-composer-support-is-now-in-beta", "markdown": "https://wpnews.pro/news/php-and-composer-support-is-now-in-beta.md", "text": "https://wpnews.pro/news/php-and-composer-support-is-now-in-beta.txt", "jsonld": "https://wpnews.pro/news/php-and-composer-support-is-now-in-beta.jsonld"}}