Supply Chain Security

Articles about Supply Chain Security by Sebastian Bergmann

Close-up of a red fire extinguisher's valve: the pressure gauge needle sits in the green zone, a yellow plastic seal secures the safety pin, and a yellow tag hangs from the neck. The tag has fields for model number and manufacturer, owner ID, and a monthly inspection record with columns for date, inspector, and comments. Every field is still blank. A visual metaphor for a component record: the form exists, but it only proves something once someone fills it in.

October 5, 2026

What ISO/IEC 18974 asks of your composer.lock

ISO/IEC 18974 describes what an open source security assurance program has to prove. Composer already produces much of that evidence as a by-product of every build. What it does not produce: an archive, a second look at software that has already shipped, and a name next to every responsibility.

A worn metal checklist card hangs in the cockpit of an aircraft in front of dimly glowing flight instruments. The card is engraved with a list titled BEFORE TAKEOFF, whose items read Flight Controls CHECKED, Takeoff Briefing REVIEWED and Cabin SECURE, followed by a dashed line reading CLEARED FOR TAKEOFF and the beginning of an AFTER TAKEOFF section.

August 19, 2026

So you received a security report. Now what?

A guide for PHP project maintainers, from the PHP Foundation Ecosystem Security Team.

A sealed shipping box is handed across a counter, along with a clipboard holding a form. A packing note listing the enclosed items with quantities and prices is affixed to the box. A visual metaphor for a bill of materials that is created while packing and ships with the package instead of being guessed at afterwards.

August 5, 2026

Your composer.lock knows what a carmaker only guesses

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring. Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents.

A hand presses the red emergency stop button of an industrial machine. A visual metaphor for a switch that halts the execution of code: exactly what zend.disable_eval does for eval().

July 29, 2026

When static analysis runs your code

A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool. Why disable_functions cannot reach eval(), and what a switch in the PHP engine to disable it could look like.

A heavy steel chain lies on a dark surface. Where a link is missing, a thin knotted orange rope ties the two ends together. A visual metaphor for a supply chain whose strength is decided by its weakest link.

July 15, 2026

Composer and Packagist under supply chain stress

2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems. A review of Composer and Packagist: what PHP does well, what it can learn — and who owns our infrastructure.

Only what must exist has a door. The safest door is the one that was never built.

May 20, 2026

The attack surface begins in the repository

We protect what exists. But do we ask often enough whether it should exist at all? How removing unused branches can protect against Poisoned Pipeline Execution.

A heavy steel chain breaks at its central link in a burst of red-orange sparks, with fragments of binary digits scattering outward against a deep blue, circuit-lit background. A visual metaphor for the supply-chain security failure that workflow hardening is meant to prevent.

May 17, 2026

Hardening GitHub Actions workflows

A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.

A bouncer in a black suit, earpiece in, hand raised in a firm "stop" gesture at the door of a club. Behind him, a queue of hopeful guests waits behind a golden velvet rope. A visual metaphor for a gatekeeper deciding who gets in and who does not.

April 18, 2026

The Bouncer in the Dependency Resolver

Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself. This article walks through how the mechanism works, how it relates to the older packages it replaces, and where it can bite you.

The image shows a wooden sign with the word "CLOSED" written on it. The sign is photographed at an angle and, thanks to its warm, brownish colouring, blurriness and strong grain, has a particularly atmospheric and nostalgic feel. It is reminiscent of a photograph taken in a small, cosy shop or café at closing time.

February 21, 2020

PHPUnit: A Security Risk?

The long story of a security problem that should not have been one.

The image shows a concrete wall with a rough surface and visible horizontal lines and joints. Shadows fall on it, forming patterns, presumably from plants or leaves. The shadows create an interesting interplay of light and dark, giving the image a calm, natural atmosphere.

February 1, 2019

Blast from the Past

Package managers are worthwhile targets, even if no one uses them anymore. Background information on the breach of the PEAR infrastructure of the PHP project.

Stay up to date

A new article is published every Wednesday. Subscribe to the RSS feed and it arrives straight in your feed reader.

The newsletter brings you a comprehensive analysis of new PHPUnit features, implementation details, and the strategic considerations behind each improvement via email every two months.

Subscribe to the RSS feed Subscribe to the newsletter