Laravel-Lang supply chain attack: 700+ PHP package versions backdoored with credential stealer (Aikido + Socket, May 22 2026)
Researchers at Aikido Security and Socket disclosed a supply chain attack on May 22nd that rewrote over 700 historical version tags across four widely used Laravel-Lang PHP localization packages. A backdoor in a helper file auto-loads on every request and exfiltrates AWS, Azure,
Researchers at Aikido Security and Socket disclosed a supply chain attack on May 22nd that rewrote over 700 historical version tags across four widely used Laravel-Lang PHP localization packages (lang, attributes, http-statuses, actions). No code was committed to the official repositories: the attackers exploited a GitHub quirk that lets version tags point to commits inside a fork they controlled. A modified helper file is registered for autoload, so the backdoor runs on every PHP request, fetching a credential stealer with 15 collector modules that targets AWS keys, Azure tokens, Kubernetes configs, HashiCorp Vault tokens, SSH private keys, browser passwords, KeePass, and 1Password vaults. Stolen data is encrypted and exfiltrated to flipboxstudio.info. Packagist has pulled the affected versions; teams running Laravel-Lang should audit composer lock files and rotate any secrets touched by a build pipeline since the bad tags went live.