PHP Attack Infects Packages with Malware to Steal Data on Linux

Published on May 24, 2026 | Translated from Spanish

An attack targeting the official PHP repository has compromised at least eight packages, injecting malware designed to steal passwords and execute remote commands on Linux systems. Cybercriminals exploited the inherent trust in the open-source ecosystem to distribute malicious code. Developers are urged to review their dependencies and employ analysis tools to avoid falling victim to this threat.

Technical illustration showing a Linux terminal screen with eight compromised PHP package icons, each displaying a red malware injection alert, while a malicious code string flows from a compromised repository into a server rack, a developer workstation in foreground shows dependency scanning tool detecting the threat, glowing red data streams extracting passwords and executing remote commands, dark server room with blue ambient lighting, realistic industrial visualization, cinematic security breach scene, detailed code syntax highlighting, network cables pulsing with malicious traffic, photorealistic engineering render

How malicious code infiltrates trusted dependencies 🛡️

The attackers manipulated legitimate packages from the PHP repository, adding payloads that activate during installation or execution. The malware operates in the background, extracting credentials stored on the system and opening backdoors for remote command execution. This attack highlights a common vector: the assumption that all code in official repositories is secure. To mitigate this, it is recommended to verify checksums, use isolated environments, and audit the source code of each dependency.

Free software gives you freedom, and also malware as a bonus 😈

Because nothing says trust like downloading a PHP package and getting a password manager for cybercriminals as a freebie. Open source is great, but it seems some decided to take it literally: open for everyone, even for those who want to steal your keys. So you know, before updating, better take a look at what you are installing. Or at least, enjoy the ride.