Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
- Trevor Norris
- Benjamin Barslev
Today, Socket’s PHP and Composer support is moving from Experimental to Beta and is now enabled for all customers. PHP reachability analysis is also generally available, helping teams determine which vulnerabilities in their dependencies can be reached from their application code.
We introduced PHP and Composer support earlier this year with package search, dependency scanning, SBOM generation, CVE detection, and AI-powered analysis for Packagist packages. Moving to Beta makes that protection available across every customer organization without requiring Experimental access.
Socket Research Has Tracked Attacks Across the PHP Ecosystem
Since launching PHP support and beginning continuous scanning of Packagist, the Socket Threat Research team has identified malicious packages, compromised repositories, and campaigns moving into PHP from other ecosystems.
In April, we watched Mini Shai-Hulud jump from npm to Packagist through a malicious version of Intercom’s PHP package. The package abused Composer plugin execution to steal cloud and CI/CD credentials.
Socket researchers later found a malicious postinstall hook across more than 700 GitHub repositories, including PHP packages distributed through Packagist. We also identified malicious code in a development version of a legitimate Laravel package linked to Famous Chollima activity. The loader used blockchain infrastructure to retrieve and execute remote code in an apparent developer-targeting campaign.
Attackers have also used familiar PHP tooling as cover. We found malicious Packagist packages disguised as Laravel utilities that deployed an encrypted PHP remote access trojan, along with six packages posing as CMS themes that shipped trojanized jQuery to exfiltrate URLs, inject ads, and redirect visitors.
These incidents show why PHP security requires more than matching package versions against known CVEs. Teams also need visibility into malicious packages, compromised releases, poisoned development branches, and install-time behavior.
PHP Projects Now Receive Full Dependency Analysis
Socket analyzes both composer.lock
and composer.json
files to resolve PHP dependency trees and identify the packages and versions used across a project.
Support includes:
- SBOM generation for PHP projects, with or without a lockfile
- Direct and transitive dependency analysis
- CVE detection across Packagist packages
- CISA KEV, CWE, and EPSS context for vulnerabilities
- AI-powered analysis for malicious and suspicious package behavior
- Separate identification of development dependencies
- Support for repositories containing multiple Composer projects
- Supply chain attack campaign tracking
Socket also continuously monitors packages and updates published to Packagist, helping teams identify malicious code before it reaches their projects.
PHP Reachability Is Now Generally Available
Finding a vulnerable package version does not tell you whether an application can invoke the vulnerable code. Reachability analysis examines the functions involved and helps teams separate vulnerabilities that need attention from those that cannot be reached.
Socket now provides two forms of reachability analysis for PHP:
- Precomputed Reachability analyzes function calls within the dependency graph and can flag around 60% of vulnerabilities in transitive dependencies as irrelevant. It works from Composer manifests without requiring access to application source code or additional configuration.
- Full Application Reachability analyzes both application source code and dependency code, showing whether an application can reach a vulnerable function and the call path that leads to it. This deeper analysis can eliminate up to 90% of false positives.
The PHP analysis engine accounts for language patterns that make static analysis difficult, including magic method dispatch through __call
, dynamically instantiated classes, and string-keyed service containers used by frameworks such as Laravel and Symfony.
Check out our previous PHP Reachability technical overview for a more comprehensive explanation of the underlying analysis and a walk through of how it would apply to a real Guzzle vulnerability.
Available Today
PHP and Composer support is now available in Beta for all Socket customers. PHP reachability analysis is generally available for customers on the Team plan tier and higher, and no longer requires Experimental access.