Top Tweets for #composerPHP
Packagist turns 15 years old and has served more than 200 billion package installs π
A look back at how Composer and Packagist started, 15 years of milestones, 2026 AI growth and what comes next.
https://t.co/TSAVrvqvWi
#php #phpc #composerphp
We're super excited for #SymfonyCon 2026 in Warsaw Nov 26-27 and happy to sponsor again! A must-go for anyone working with PHP and #Symfony. Great content, fantastic people. Now more than ever: educate yourself and keep with ecosystem & tech in general.
#php #phpc #composerphp
Malware detection and strict dependency policiesπ
Catch Nils Adermann & Jordi Boggiano at SymfonyCon Warsaw 2026 for a look inside Packagist's security overhaul and best practices for your stack https://t.co/xIIutUCfpT
New in Private Packagist, August '26 update: Organization-wide supply chain security controls, MFA enforcement for CLI access, GitLab subgroup sync, artifact packages for suborgs via API, and more complete audit logging.
https://t.co/g0Z1zVrkZa
#php #phpc #composerphp
Composer & Packagist now have a sponsorship program. Thank you to our launch sponsors π€ @AikidoSecurity, @awscloud, @SocketSecurity, @BunnyCDN, @upsundotcom, @sonatype, @tideways, @datadog and @algolia for sharing this burden.
https://t.co/2FC2w8Y3Tx
#php #phpc #composerphp
I both love and hate this: Has #composerphp now reached python wheel levels and we soon need analysis tools to figure out which C libraries containing which CVEs exactly were compiled into which extensions shipping inside which php phar files in Composer packages? π΅βπ«
Announcing PHPStan Turbo! Native PHP extension (PHP 8.3+) written in C++ that makes running PHPStan 10-30 % faster.
The best part: If you update to PHPStan 2.2.6, you get it automatically. It ships with pre-built binaries for all the usual combos of OS:architecture:PHP.
We're excited to announce @upsundotcom is now sponsoring #composerphp & Packagist maintenance, ops and development! They have a long history in the #PHP ecosystem. Their contribution helps us push forward with our work on improving supply chain security for the PHP ecosystem.
CI/CD pipelines are a prime target for supply chain attacks. We hardened the #GitHubActions workflows for Composer, Packagist and Private Packagist with #zizmorπ, a GHA static analysis tool and wrote down how to the same for yours π #php #phpc #composerphp
π Stable versions on Packagist are now immutable. Once published, the commit a version points to can no longer change. Retags are blocked, deletions are tracked with a reason and recoverable, and everything is recorded on the public transparency log.
#php #phpc #composerphp
Busy times: Here are my slides on Composer & Packagist Supply Chain Security from #PHPVerse: https://t.co/K71pAyaHJy
Thanks @jetbrains for a great online event! Videos soon! Follow https://t.co/yHdJczYBMn for updates.
#php #phpc #composerphp #supplychainsecurity
𧩠Composer plugins are powerful, but execute code during install & update. Composer prompts to allow a plugin, but a distracted "yes" or an AI agent on autopilot is all it takes. Private Packagist now has org-level allowlists for plugins. #php #phpc #composerphp
β οΈ Real PHP packages. Real attacks. Real consequences.
@naderman is live in 5 mins at #PHPverse 2026 breaking down how supply chain attacks hit the PHP ecosystem β and everything Packagist has done to fight back.
If you use #composerphp, this is required viewing π https://t.co/ABcvzIfhcG
The Composer CLI is part of your supply chain. Older versions miss the protections in 2.10 and carry known CVEs of their own.
Private Packagist customers can now enforce which Composer client versions can talk to their repository.
#php #phpc #composerphp
β Composer policies block flagged malware, but only on 2.10. A CI image running an old Composer version, or a project disabling the policy, still installs flagged versions.
Private Packagist now blocks these at the registry, on any client.
#php #phpc #composerphp
π‘οΈ Composer's download fallbacks can silently undermine repository security: A Private Packagist URL blocked for a malware-flagged version falls back to GitHub or a source clone.
Two new Private Packagist options close it off.
#php #phpc #composerphp
Composer 2.10 is out.
Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.
#php #phpc #composerphp
πAn update on Composer & Packagist supply chain security: what's in place, what ships this week with Composer 2.10 (dependency policies, immutable versions), and what comes next.
If you maintain PHP packages, enable MFA now!
#php #phpc #composerphp
It took us a bit longer than expected but after over a month of discussions and rewrites, Composer 2.10 RC2 is now available for testing with a new policy config and detected malware now blocked by default on install. https://t.co/HrM6zu8asZ #composerphp #phpc
If you haven't updated Composer to 2.9.8 or 2.2.28 (LTS), do so urgently! GitHub will restart the rollout of their new GitHub Actions tokens later today. They've improved secret masking to cover this Composer issue, but you're safer if you update. #composerphp #php #phpc
π¨ Security advisory: Composer 2.9.8 and 2.2.28 are out and fix a vulnerability leaking GitHub Actions new format GITHUB_TOKENs into job logs via error messages.
Update now (composer self-update) or disable affected Actions workflows.
#composerphp #phpc #php
Three months of Private Packagist updates: Malware filter list support already in place, ahead of Composer 2.10's release next week. Plus a new package permissions tab, better background job visibility, and a narrower GitLab OAuth scope. Link π
#php #phpc #composerphp
We hope you enjoyed @glaubinix talk on the malware filtering features in Composer 2.10 at phpday. Try them out on latest snapshots today. Appreciate early feedback! Proud to sponsor @phpday in Verona, Italy! #php #phpc #phpday #composerphp
Last Seen Hashtags on Sotwe
anxiouspanda
Seen from Egypt
ebony #amateur
Seen from Germany
xianrnya
Seen from Malaysia
bicurious
Seen from United Kingdom
snapchat video
Seen from Algeria
anxiouspanda()************************ filter:videos
Seen from Israel
teenageee
Seen from Mexico
gaytwerking
Seen from United Kingdom
facundogonzalez
Seen from Italy
Bebymoy
Seen from Netherlands
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.9M followers
Cristiano Ronaldo
@cristiano
114.6M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90.1M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.6M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers