Summary
A widely used PHP code-analysis library, PHPCSUtils, has patched a code execution vulnerability that put developer machines and build servers at risk …
The flaw, tracked as CVE-2026-65954 and rated 8.6 out of 10 in severity, affects PHPCSUtils versions 1.0.0-alpha1 through 1.2.2. The library underpins custom PHP_CodeSniffer checks used to enforce coding standards. When a scan runs over untrusted PHP code - for example a continuous-integration pipeline that lints incoming pull requests, or a developer reviewing third-party code - the flaw could allow arbitrary code to execute on the machine running the scan.
The fixed release is PHPCSUtils 1.2.3. Development teams should update the phpcsstandards/phpcsutils package in their tooling and rebuild CI images that bundle older copies, since the vulnerable code runs with the permissions of the build environment, which often holds repository and deployment credentials.
Source: GitHub Security Advisories
