Nils Adermann

Nils Adermann

@naderman.de

Co-Founder of @packagist.com / http://packagist.com and Co-Creator of #composerphp - he/him - @naderman@phpc.social

829 followers241 following154 posts

Nils Adermann reposted

The PHP Foundation
@thephpf.bsky.social

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

Nils Adermann reposted

Vlad Miricioiu 🌸
@vlad.website

We just gave $1,000,000 to Open Source maintainers at @sentry.io, up from $750K last year! 🎉️ And this month the @opensourcepledge.com turns 2. Its 37 member companies have now paid $8,421,535 to the people who build the software we all rely on. Read on to find out where the money went.

blog.sentry.ioWe just gave a million dollars to Open Source maintainersSentry raised its Open Source budget from $750,000 to $1,000,000 this year. Here's why, and how we split it among maintainers and foundations.
Nils Adermann
@naderman.de

Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.

The PHP Foundation@thephpf.bsky.social

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes & more. thephp.foundation/blog/2026/1...

thephp.foundationToday's PHP Security Release, and How We're Strengthening PHP SecurityDescribing the story behind how critical security vulnerabilities were found and fixed.

Nils Adermann reposted

The PHP Foundation
@thephpf.bsky.social

Replying to @thephpf.bsky.social

If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.

Nils Adermann reposted

The PHP Foundation
@thephpf.bsky.social

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

Nils Adermann reposted

Packagist
@packagist.com

Packagist turns 15, with more than 200 billion package installs 🎉 How Composer and Packagist started, 15 years of milestones, recent growth, and our plans for supply chain security and funding. blog.packagist.com/15-years-of... #php #phpc #composerphp

Nils Adermann reposted

Packagist
@packagist.com

We're super excited for #SymfonyCon 2026 in Warsaw Nov 26-27 and happy to sponsor again! A must-go for anyone working with PHP and #Symfony. Great content, fantastic people. Now more than ever: educate yourself and keep up with ecosystem & tech in general. #php #phpc #composerphp

Symfony@symfony.com

🎉We already have our next #SymfonyCon stop for you!✨ 💜Get ready for: Warsaw, Poland 2026! Where the very first SymfonyCon took place back in 2013 💙 🎟️Get your tickets: live.symfony.com Don’t miss the chance to connect with the Symfony community again ! 🎊 #Symfony

Nils Adermann reposted

Matt Hodges
@matthodges.bsky.social

Very quick and dirty Jev test for hiring bias. One resume for a Wall Street job; asked whether the applicant should get a first-round interview. 76 evaluations, changing only the first name. 19 of each: White-associated men/women, Black-associated men/women. console.typesafe.ai/playground?s...

Matt Hodges@matthodges.bsky.social

Somehow Jev has not yet triggered much discussion of cheap, low-latency, general-purpose classification as infrastructure for targeted oppression.

Nils Adermann
@naderman.de

Takeaway from a brief AI doom tangent at dinner: Gustav Mahler is known for saying "When the world ends, I'll move to Vienna. Everything happens 50 years later there" Vienna School of Agentic Engineering goal to ward off the apocalypse for 50 years? 🤣

Nils Adermann reposted

Packagist
@packagist.com

New in Private Packagist, August '26 update: Organization-wide supply chain security controls, MFA enforcement for CLI access, GitLab subgroup sync, artifact packages for suborgs via API, and more complete audit logging. blog.packagist.com/whats-new-i... #php #phpc #composerphp

Nils Adermann reposted

Open Source Pledge ⇌
@opensourcepledge.com

Package managers support our world's infrastructure, but those who build them have more work on their plate then ever. Companies who rely on this work for their revenue should give something back. It's in these companies' interest to keep this tech sustainable.

Packagist@packagist.com

Composer & Packagist now have a sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia help fund our shared infrastructure. blog.packagist.com/announcing-... #php #phpc #composerphp

Nils Adermann
@naderman.de

We launched our sponsorship program as a step toward more distributed funding of critical open source infrastructure. Long term we want to move from sponsorships to regular service subscriptions paid from engineering budgets. Two partners deserve a special mention: #php #phpc #composerphp

Packagist@packagist.com

Composer & Packagist now have a sponsorship program. Thank you to our launch sponsors 🤝 Aikido, AWS, Socket, Bunny, Upsun, Sonatype, Tideways, Datadog and Algolia help fund our shared infrastructure. blog.packagist.com/announcing-... #php #phpc #composerphp

Nils Adermann
@naderman.de

Thanks to @brianfox.bsky.social and Sonatype: a key role in the Sustaining Package Registries Working Group as steward of Maven Central, and now sponsoring us, even though one of their products competes with our Private Packagist. The infrastructure underneath is shared, we fund it together.

Nils Adermann reposted

Packagist
@packagist.com

CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with 🌈zizmor and wrote down how to do the same on yours. blog.packagist.com/securing-ou... #php #phpc #composerphp #github #githubactions #zizmor

blog.packagist.comSecuring our GitHub Actions workflows with zizmorThis is the next post in our supply chain security series, following the supply chain security update, the Composer 2.10 release and immutable version metadata on Packagist.org. The earlier posts covered Composer behavior, changes to Packagist.org, and Private Packagist features. Today we’ll cover how we hardened
Nils Adermann
@naderman.de

So I'm trying to contact a bunch of enterprises with SDKs on packagist to help with sponsorships. But what I'm finding instead is that their SDKs are mostly owned by ex-employee accounts with private email addresses or bouncing corporate emails. 😵‍💫

Nils Adermann reposted

Packagist
@packagist.com

📌 Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, and deleted versions are tracked with a reason and recoverable. blog.packagist.com/immutable-v... #php #phpc #composerphp

Nils Adermann reposted

Josh Bressers
@josh.bressers.name

I had a chat with Jordi Boggiano from Packagist about a heap of security features they recently added and adding in the future The security of the public package repositories is a hot topic right now, Packagist is doing some really interesting things to improve their security

opensourcesecurity.ioPackagist and Composer security with Jordi BoggianoJosh welcomes Jordi Boggiano the lead maintainer of Composer and Packagist to explain the truckload of security features they’ve recently added. Packagist is the PHP package registry, Composer is the ...

Nils Adermann reposted

Packagist
@packagist.com

🧩 Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins. blog.packagist.com/restricting-... #php #phpc #composerphp

blog.packagist.comRestricting Composer plugins across your organizationThis is the next post in our supply chain security series, following the supply chain security update, the Composer 2.10 release, closing Composer's download fallback paths, blocking malware downloads...
Nils Adermann
@naderman.de

Looking forward to talking about Composer and Packagist Supply Chain Security in 2026 at the JetBrains PHPverse 2026 on June 9 - Join us for a free virtual event bringing together developers, ideas, and energy from across the PHP ecosystem. #PHPverse2026 jb.gg/3ldzpb

jb.ggJetBrains PHPverse 2026 – Bringing the PHP Community TogetherJoin us for a free virtual event bringing together developers, ideas, and energy from across the ecosystem. Enjoy insightful talks, exciting announcements, and a look at the future of PHP development.

Nils Adermann reposted

Packagist
@packagist.com

The Composer CLI is part of your supply chain. Older versions miss the protections from 2.10 and have known CVEs of their own. Private Packagist customers can now enforce which Composer versions are allowed to use their repository. blog.packagist.com/enforce-a-sa... #php #phpc #composerphp

blog.packagist.comEnforce a Safe Composer Version Across Your OrganizationThis is the next post in our supply chain security series, following the supply chain security update, the Composer 2.10 release, closing Composer's download fallback paths, and blocking malware downl...

Nils Adermann reposted

Packagist
@packagist.com

⛔ Composer policies block flagged malware, but only on 2.10. A project disabling the policy, or a CI image running an old Composer, still installs flagged versions. Private Packagist now blocks these at the repository, for all versions. blog.packagist.com/blocking-mal... #php #phpc #composerphp

blog.packagist.comBlocking Malware Downloads for Every Composer Version in Private PackagistThis is the next post in our supply chain security series, following the supply chain security update, the Composer 2.10 release, and the recent post on closing Composer's download fallback paths. Co...

Nils Adermann reposted

Packagist
@packagist.com

🛡️ Composer's download fallback behavior can silently override security decisions at the repository side, falling back from a blocked Private Packagist URL to GitHub or a source clone. Two new Private Packagist options close it off. blog.packagist.com/closing-comp... #php #phpc #composerphp

Nils Adermann reposted

Jordi Boggiano
@seld.be

I realized I was never going to get to adding zizmor to all my repos so I made a claude skill to let it do the grunt work. You can use it too, if it helps more busy/lazy people to secure their GitHub repos I am glad! See github.com/Seldaek/zizm...

github.comGitHub - Seldaek/zizmorify: Agent skill to harden GitHub Actions by adding zizmor to your CI and fix existing workflow errorsAgent skill to harden GitHub Actions by adding zizmor to your CI and fix existing workflow errors - Seldaek/zizmorify
Packagist@packagist.com

We recommend you change the default permissions for GitHub Actions GITHUB_TOKENs to read only. Explicitly grant elevated permissions only where strictly necessary. Use zizmor to analyze your GitHub Actions: github.com/zizmorcore/z... see also: phpunit.expert/articles/har...

Nils Adermann reposted

Jordi Boggiano
@seld.be

📦 Composer 2.10 is out. Native malware filtering via @aikidosecurity.bsky.social (enabled by default on Packagist), a unified config.policy framework for advisories/abandoned/malware, and source fallback now deprecated. blog.packagist.com/composer-2-1... #php #phpc #composerphp

blog.packagist.comComposer 2.10 ReleaseWe are excited to announce the release of Composer 2.10.0, introducing native malware filtering and consolidated future-proof customizable dependency policy configuration to control the handling of se...

Nils Adermann reposted

Packagist
@packagist.com

🔒 An update on Composer & Packagist supply chain security: where we stand, what ships this week with Composer 2.10, what's next. If you maintain PHP packages, enable MFA now. blog.packagist.com/an-update-on... #php #phpc #composerphp #supplychainsecurity

blog.packagist.comAn Update on Composer & Packagist Supply Chain SecurityThe last months, and even more so the last weeks, saw an increasing amount of software supply chain attacks targeting open-source ecosystems. A handful of these have hit the PHP ecosystem too, via tak...
Nils Adermann
@naderman.de

This pressure @seld.be and I can certainly relate to. 😵‍💫 Here's hoping we'll figure out a better way forward soon.

daniel:// stenberg://@bagder.mastodon.social.ap.brid.gy

The pressure for us in the #curl project right now https://daniel.haxx.se/blog/2026/05/26/the-pressure/

daniel.haxx.seThe pressureI’m doing Open Source primarily because I love it. The social aspects, the for-the-good angle and for the challenge of engineering this to work for everyone. I also do it because it is my full-time job and getting food on the table and provide for my family is not unimportant. It may come as a shock, but I am not in this game for the money or the extravagant life style. I have been working full-time on curl since 2019. For me, this typically means doing 50 hour work weeks, as I spend all days on it and then I top them off with a few more hours every late night – all days of the week, I spend all this time on curl because it is a work of love and it is both my job and my spare time hobby and no one counts my hours anyway. (And no, I do not recommend anyone else to do the same. I’m not suggesting this for others.) I consider my primary work-related mission in life to be to make curl the best transfer library and tool possible and make it qualify as a top project in Open Source, quality, performance and not the least, security. I believe we generally meet these lofty goals. I founded the curl project, I am still a lead developer in the project almost thirty years later. While I always clearly state that _curl is not a one-man shop_ and that curl would absolutely not be what it is without my awesome curl team mates, a large part of the world still thinks of curl as my project and sometimes more or less equals curl with my person. I cannot help to take curl issues personally. When someone critiques curl, it is by extension a complaint on decisions and choices I stand by and behind – and many cases I made the calls. curl _is_ personal to me. curl has formed my life forever. I have two kids. They were both born many years after I started working on curl and they are both adults and independent individuals now. I love them dearly. Life passes by but curl remains. We’ve had slow times and busy times. The decades pass. Later this year the curl project celebrates thirty years. We typically repeat that the number of curl installations in the world is perhaps thirty billion. ## Things changed Over the last years I have done numerous blog posts on the state of security reports submitted to curl. They have gradually switched over from complaints on stupid LLMs, to stupid AI slop reports, closing the bug bounty over to the current high quality chaos which for us started maybe at some point in March 2026. We have seen many spectacular security failures through the years, in Internet products, in software infrastructure and in Open Source. Every time we read about those events, we get reminded about how curl is everywhere and how we really really _really_ do not want anything such to happen to us or our users. And we take another lap around the project, tighten every bolt a little more, add a few more checks, tests and guidelines to ideally make the curl ship ever so slightly less likely to ever leak or sink. ## Scrutinized Recently, after I pointed out that Mythos only found a single low severity problem in curl in its first scan, countless people have repeated the claim that curl is one of the most scrutinized, most reviewed, most fuzzed and most verified source codes you can imagine. Perhaps that’s true, but I just want to mention this: that’s not by mistake. That’s not an accident or a happy circumstance. That’s the result of relentless work and attention to details through decades. _Software engineering done right_. Iterative improvements over time that simply never ends is an effective method. This does not however mean that we don’t have bugs or that we don’t have security problems left, because we do. We have hundreds of thousands of lines of source code that is doing highly parallel networking for many protocols on all imaginable operating systems and CPU architectures – in C. So we fix the problems, patch them up and ship new releases. Over and over. Thirty billion installations world-wide means that everyone reading this blog post has curl installed multiple times in stuff they own. In phones, tablets, cars, TVs, printers, game consoles, kitchen equipment and more. Not to mention all the online digital services we use and those devices communicate with. I cannot stress the importance of curl security and I would guess that most of you agree with me. I am jealous of those projects that shipped a horrible bug at some point in the past that made the world burn for a while. They got attention and some of them then got funding and financial muscles to get them staff and hire multiple full time engineers. I sometimes think we would be better off if we also had one of those. ## Never-before experienced A thirty years old project could make you think you’ve seen most things already, but we have not been in this situation before. The rate of incoming security reports is 4-5 times higher than it was in 2024 and double the speed of 2025 – meaning that **on average we now get more than one report per day**. The quality is way higher than ever before. The reports are typically _very_ detailed and long. In order to manage this incoming flood of submissions, we need to make sure to handle them as soon as possible as we know there are more coming. If we don’t take care of them roughly at the same speed they arrive, the backlog just grows and having that list of potential security problems in a list that you don’t have control over takes a mental toll. I spend almost all my days right now working through the list of reported security issues that we have on Hackerone. Verify the claim, assess the importance, write a patch, figure out when the bug was introduced, understand the vulnerability, write a detailed advisory explaining the problem to the world and communicate all this with the security researcher and the rest of the curl security team. ## A health concern For the first time in my life, my wife voiced concerns about my work hours and my imbalanced work/life situation. I work more than I’ve done before, but the flood keeps coming. People in my surrounding, I guess reading between the lines, have asked me how I and we cope with this deluge and want to make sure we don’t burn in the process. I am concerned for my team mates. I might soon have to reduce my work hours to allow myself more breathing time. This is a never-before seen or experienced pressure on the curl project and its security team members. An avalanche of high priority work that trumps all other things in the project that is primarily mental because we certainly _could_ ignore them all if we wanted, but we feel a responsibility, we have a conscience and we are proud about our work. We feel obliged to fix security problems in the software we have helped shipped to every device on the globe. This is personal to us. With about half the release cycle left until the pending release ships, we already have _twelve confirmed vulnerabilities_ meaning twelve pending CVE announcements. That’s a new project record and it also means we will reach _thirty_ published CVEs in 2026 even before half the calendar year has passed. The projected total amount of curl CVEs published through the whole year is therefore at least double this number! ## Assistance What help would we like? Short term it is a little late. We already have work up to our ears. I wish more companies that use and depend upon curl or libcurl in commercial software and services would chime in their part to fund us. We could then pay more developers to distribute the work load across. That would be great. Feel free to contact me to discuss how you can contribute to this. Get your employer to pay for a support contract! Fortunately we have customers who already do this, so some of us can work on curl full time. I am a pragmatic (and a bit of a cynic) and I have danced this dance for a long time already. I have no illusions that anything significant is going to change in this area even if we are in an unparalleled situation and in a tighter spot than ever before. I totally expect us to ride out this storm by ourselves. Like we are used to. We will survive. We will endure. It might just be a bit of a shaky period in the project and in the world at large as we try to maneuver our way through this. There’s a tsunami coming over us and all we can do is swim, there are no life boats for us. The curl project is not owned by a company. We are not part of any umbrella organization. This makes us a little under-powered at times, but it also gives us maximum freedom and flexibility. We act solely in the interest of making curl as good as possible for the world and curl users. ## The good part Fixing bugs and problems is good. Every reported problem implies a fixed issue. curl becomes a better product. What is also a good trend: almost no one finds _terrible_ vulnerabilities. All vulnerabilities found the last few years in curl have _all_ been deemed severity LOW or MEDIUM. I’m not saying there won’t be any more HIGH ever, but at least they are rare. The most recent severity high curl CVE was published in October 2023. ## Pressure Right now we are under a little pressure. Forgive us if we are a little slow to respond sometimes. ## Credits Image by Brian Merrill from Pixabay

Nils Adermann reposted

Fabien Potencier
@fabien.potencier.org

As an OSS maintainer, my new rule is that anything a frontier model can find with some reasonable effort is a 0-day. Hence why I'm now shipping security releases on public holidays.

Nils Adermann reposted

Jordi Boggiano
@seld.be

It took us a bit longer than expected but after over a month of discussions and rewrites, Composer 2.10 RC2 is now available for testing with a new policy config and detected malware now blocked by default on install. github.com/composer/com... #composerphp #phpc

github.comRelease 2.10.0-RC2 · composer/composerComposer 2.10 is ready for a release, and we need your help to test it and report any regression. Please try it out! Running composer self-update --preview will get you the 2.10.0-RC2 Running comp...

Nils Adermann reposted

Packagist
@packagist.com

If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc

Packagist@packagist.com

🚨 Security advisory: Composer 2.9.8 and 2.2.28 fix a vulnerability leaking GitHub Actions GITHUB_TOKENs to job logs via error messages. Update now or disable affected workflows. blog.packagist.com/composer-2-9... #composerphp #phpc #php

blog.packagist.comComposer 2.9.8 and 2.2.28 fix GitHub Actions token disclosure in error messagesPlease immediately update Composer to version 2.9.8 or 2.2.28 (LTS) by running composer.phar self-update. The new releases fix a vulnerability where Composer leaks the full contents of GitHub Actions ...

Nils Adermann reposted

Packagist
@packagist.com

Three-month Private Packagist recap: malware filter list support is already in place, ahead of Composer 2.10's release next week. Plus a new permissions tab, better job visibility, and narrower GitLab OAuth scopes. blog.packagist.com/whats-new-in... #php #phpc #composerphp

blog.packagist.comWhat's New in Private Packagist, May 2026 UpdateOver the past three months, we've shipped updates focused on security, integrations with code hosting platforms, and usability improvements throughout Private Packagist. Here's a rundown of the most n...

Nils Adermann reposted

Packagist
@packagist.com

🚨 Security advisory: Composer 2.9.8 and 2.2.28 fix a vulnerability leaking GitHub Actions GITHUB_TOKENs to job logs via error messages. Update now or disable affected workflows. blog.packagist.com/composer-2-9... #composerphp #phpc #php

blog.packagist.comComposer 2.9.8 and 2.2.28 fix GitHub Actions token disclosure in error messagesPlease immediately update Composer to version 2.9.8 or 2.2.28 (LTS) by running composer.phar self-update. The new releases fix a vulnerability where Composer leaks the full contents of GitHub Actions ...
Nils Adermann
@naderman.de

Open infrastructure isn't free. 🌱 Packagist/Composer signed a joint @openssf.org letter with PyPI, crates, Maven, CPAN, etc on real cost of running package registries. #php #phpc #composerphp #softwaresupplychain #PreserveOpenSource #FreeSoftwareIsntFree #OpenSource #Sustainability

OpenSSF@openssf.org

Open Infrastructure Is Not Free Part II 10 trillion open source package downloads in 2026. Still running on donations and volunteers. AI is accelerating attacks. The Sustaining Package Registries WG is here to help. openssf.org/blog/2026/05... #PreserveOpenSource

Nils Adermann
@naderman.de

Packagist needs to finance staff, not just hardware and bandwidth. Contact me if your company's interested in joining our sponsorship program for its launch this month while we work on long term solutions.

Nils Adermann reposted

Ahmad Nassri
@ahmadnassri.com

⚠️ If you're running local mcp servers, you need to do the following: 1. Individually "install" packages you want to use, within a specified directory: (e.g. $HOME/mcp) creating a lockfile 2. Add: "--include-workspace-root --workspace $HOME/mcp --no --offline" to EVERY npx call

Socket@socket.dev

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

socket.devThe Hidden Blast Radius of the Axios Compromise - SocketThe Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.