CVE-2026-65954

Packagist/phpcsstandards/phpcsutils CVE-2026-65954: high 8.6, EPSS 0.21%

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Action: Upgrade phpcsstandards/phpcsutils to 1.2.3 or later.

composer require phpcsstandards/phpcsutils:1.2.3

Affected

Fixed versions

Sources

• osv: GHSA-r6hr-vr92-vv28
• https://github.com/PHPCSStandards/PHPCSUtils/security/advisories/GHSA-r6hr-vr92-vv28
• https://github.com/PHPCSStandards/PHPCSUtils/pull/778
• https://github.com/PHPCSStandards/PHPCSUtils/commit/9f596b50ea4498ea57b8cb341e920233b044debf
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpcsstandards/phpcsutils/CVE-2026-65954.yaml
• https://github.com/PHPCSStandards/PHPCSUtils

CVE-2026-65954 · published 2026-09-29T17:57:16Z · modified 2026-09-29T18:15:04.713403731Z · JSON