PHP and Composer Support Is Now in Beta

Socket has moved its PHP and Composer support from Experimental to Beta, now enabled for all customers, with PHP reachability analysis generally available. The Socket Threat Research team has tracked attacks across the PHP ecosystem, including malicious packages on Packagist and compromised repositories, highlighting the need for comprehensive dependency analysis beyond CVE matching.

PHP and Composer Support Is Now in Beta Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available. - Trevor Norris - Benjamin Barslev Today, Socket’s PHP and Composer support is moving from Experimental to Beta and is now enabled for all customers. PHP reachability analysis is also generally available, helping teams determine which vulnerabilities in their dependencies can be reached from their application code. We introduced PHP and Composer support https://socket.dev/blog/introducing-php-and-composer-support earlier this year with package search, dependency scanning, SBOM generation, CVE detection, and AI-powered analysis for Packagist packages. Moving to Beta makes that protection available across every customer organization without requiring Experimental access. Socket Research Has Tracked Attacks Across the PHP Ecosystem Socket-Research-Has-Tracked-Attacks-Across-the-PHP-Ecosystem Since launching PHP support and beginning continuous scanning of Packagist, the Socket Threat Research team has identified malicious packages, compromised repositories, and campaigns moving into PHP from other ecosystems. In April, we watched Mini Shai-Hulud jump from npm to Packagist through a malicious version of Intercom’s PHP package https://socket.dev/blog/mini-shai-hulud-packagist-malicious-intercom-php-package-compromise . The package abused Composer plugin execution to steal cloud and CI/CD credentials. Socket researchers later found a malicious postinstall hook across more than 700 GitHub repositories https://socket.dev/blog/malicious-postinstall-hook-found-across-700-github-repos , including PHP packages distributed through Packagist. We also identified malicious code in a development version of a legitimate Laravel package https://socket.dev/blog/famous-chollima-targets-php-developers-through-compromised-packagist-package linked to Famous Chollima activity. The loader used blockchain infrastructure to retrieve and execute remote code in an apparent developer-targeting campaign. Attackers have also used familiar PHP tooling as cover. We found malicious Packagist packages disguised as Laravel utilities https://socket.dev/blog/malicious-packagist-packages-disguised-as-laravel-utilities that deployed an encrypted PHP remote access trojan, along with six packages posing as CMS themes https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery that shipped trojanized jQuery to exfiltrate URLs, inject ads, and redirect visitors. These incidents show why PHP security requires more than matching package versions against known CVEs. Teams also need visibility into malicious packages, compromised releases, poisoned development branches, and install-time behavior. PHP Projects Now Receive Full Dependency Analysis PHP-Projects-Now-Receive-Full-Dependency-Analysis Socket analyzes both composer.lock and composer.json files to resolve PHP dependency trees and identify the packages and versions used across a project. Support includes: - SBOM generation for PHP projects, with or without a lockfile - Direct and transitive dependency analysis - CVE detection across Packagist packages - CISA KEV, CWE, and EPSS context for vulnerabilities - AI-powered analysis for malicious and suspicious package behavior - Separate identification of development dependencies - Support for repositories containing multiple Composer projects - Supply chain attack campaign tracking Socket also continuously monitors packages and updates published to Packagist, helping teams identify malicious code before it reaches their projects. PHP Reachability Is Now Generally Available PHP-Reachability-Is-Now-Generally-Available Finding a vulnerable package version does not tell you whether an application can invoke the vulnerable code. Reachability analysis examines the functions involved and helps teams separate vulnerabilities that need attention from those that cannot be reached. Socket now provides two forms of reachability analysis for PHP: Precomputed Reachability https://docs.socket.dev/docs/precomputed-reachability analyzes function calls within the dependency graph and can flag around 60% of vulnerabilities in transitive dependencies as irrelevant. It works from Composer manifests without requiring access to application source code or additional configuration. Full Application Reachability https://docs.socket.dev/docs/full-application-reachability analyzes both application source code and dependency code, showing whether an application can reach a vulnerable function and the call path that leads to it. This deeper analysis can eliminate up to 90% of false positives. The PHP analysis engine accounts for language patterns that make static analysis difficult, including magic method dispatch through call , dynamically instantiated classes, and string-keyed service containers used by frameworks such as Laravel and Symfony. Check out our previous PHP Reachability technical overview https://socket.dev/blog/reachability-for-php for a more comprehensive explanation of the underlying analysis and a walk through of how it would apply to a real Guzzle vulnerability. Available Today Available-Today PHP and Composer support is now available in Beta for all Socket customers. PHP reachability analysis is generally available for customers on the Team plan https://socket.dev/pricing tier and higher, and no longer requires Experimental access.