Record · corpus.blog/posts/01a08219-c8f0-705f-bdff-b9b0fd42cfd2

So You Received a Security Report. Now What?

PHP Foundation · published 19 August 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at thephp.foundation Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 27
Words captured: 5,766

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/

mikemcquaid.com

https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability

docs.github.com

https://cwe.mitre.org/

cwe.mitre.org

https://docs.docker.com/ai/sandboxes/

docs.docker.com

sbx: Sandboxed Claude, complete with PHP and tools Read at the source ↗

beberlei.de

https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory

docs.github.com

https://github.com/advisories

github.com

https://osv.dev/

osv.dev

https://packagist.org/packages/phpunit/phpunit

packagist.org

https://docs.github.com/en/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories

docs.github.com

The Bouncer in the Dependency Resolver Read at the source ↗

phpunit.expert

https://blog.packagist.com/composer-2-10-release/

blog.packagist.com

https://blog.packagist.com/an-update-on-composer-packagist-supply-chain-security/

blog.packagist.com

https://github.com/FriendsOfPHP/security-advisories

github.com

https://github.com/github/advisory-database

github.com

https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution

owasp.org

The attack surface begins in the repository Read at the source ↗

phpunit.expert

https://docs.zizmor.sh/

docs.zizmor.sh

Hardening GitHub Actions workflows Read at the source ↗

phpunit.expert

https://discord.com/invite/RYajXKxuuK

discord.com

https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/

thephp.foundation

https://thephp.foundation/blog/2026/06/23/one-month-of-ecosystem-security-engineering/

thephp.foundation

https://alpha-omega-security.github.io/maintainers-security-advisory-guide/

alpha-omega-security.github.io

https://getcomposer.org/doc/03-cli.md

getcomposer.org

https://getcomposer.org/doc/06-config.md

getcomposer.org

https://www.first.org/cvss/

first.org

https://cna.erlef.org/maintainer-process

cna.erlef.org