CVE-2026-84361: openSUSE php-composer2 Moderate Fix — Patch, Verify, and Hunt Guide

openSUSE advisory openSUSE-2026-11689-1 ships php-composer2 2.10.3-2.1 to resolve a single moderate vulnerability tracked as CVE-2026-84361. Composer sits in the PHP supply-chain path, so prioritize CI runners, build containers, developer workstations, and any web host where Composer is reachable by a service account.

Introduction

The openSUSE security notice is short but operationally important: one vulnerability is fixed, the updated package is available, and the affected component is php-composer2. The package string in the advisory path indicates the fixed build as php-composer2-2.10.3-2.1. The news summary does not include a CVSS vector, a root-cause write-up, or confirmed exploitation, so defenders should not invent those details. The defensible posture is straightforward: inventory every openSUSE host and container layer with Composer installed, apply the openSUSE patch, verify package state with zypper and rpm, then hunt for Composer execution outside approved build contexts.

Why urgency for a moderate rating: Composer is not merely a CLI utility. It resolves dependencies, reads composer.json and composer.lock, can execute install and update scripts, may load plugins, and often handles credentials for private repositories. A flaw in that workflow can become a supply-chain pivot even when the base CVSS is not critical. Treat hosts that process untrusted PHP projects, pull from VCS remotes, or run Composer under php-fpm, nginx, Apache, or CI service accounts as higher risk than a dormant workstation package.

Technical Analysis

Affected products, versions, and platforms:

• Product: php-composer2 on openSUSE systems.
• Fixed package: php-composer2 2.10.3-2.1, per advisory openSUSE-2026-11689-1.
• Affected state: openSUSE installs with php-composer2 present and not yet updated to the fixed release. The provided summary does not enumerate Leap versus Tumbleweed releases, so confirm applicability per host with zypper patch --cve CVE-2026-84361 and the advisory metadata rather than assuming release scope.
• Exposure model: highest priority for internet-reachable build runners, shared CI agents, artifact builders, container base images, developer endpoints that open third-party PHP repos, and web servers where Composer can be invoked by deployment automation.

CVE and severity:

• CVE-2026-84361 is the only identifier provided by the source item.
• The source labels the threat moderate. No CVSS score is included in the summary, and none should be fabricated. Track NVD, openSUSE, and CISA enrichment, but do not wait for a score to patch a package that is frequently in the software build path.

Defender view of the attack chain:

• The precise vulnerable code path is not disclosed in the news summary. Do not claim a specific CWE or memory-safety class from this item alone.
• The practical exploitation prerequisite is presence of the vulnerable Composer package plus an attacker-influenced Composer workflow. In real environments that usually means a crafted or compromised composer.json, composer.lock, repository definition, package archive, plugin, script hook, or private repository interaction processed during install, update, require, dump-autoload, or exec.
• Likely impact areas to defend are dependency confusion or substitution, unintended script or plugin execution, credential leakage through repository configuration or environment, and build artifact poisoning. These are Composer-workflow risks to validate while the CVE-specific root cause is still being enriched by vendors.

Exploitation status:

• The supplied item does not state public PoC, confirmed in-the-wild exploitation, or CISA KEV inclusion.
• Verify current status against the openSUSE advisory page and CISA KEV before exceptioning or de-prioritizing. Absence of exploitation evidence is not absence of risk for CI/CD systems that continuously consume third-party code.

Detection and Response

This is a technical vulnerability item, so the following hunts are included. They are intentionally framed around unexpected Composer execution and unsafe Composer contexts rather than invented CVE-specific IOCs. Tune the filters to known CI paths, service accounts, and golden image users before broad deployment.

---
title: Composer Executed by Web or PHP Service Context
id: 8c6f9d21-7a4b-4d2e-9f31-2b6c4a7d5e90
status: experimental
description: Detects Composer launched from web server or PHP service contexts where dependency management should not normally run.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-11689-1-php-composer2-2-10-3-2-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/composer'
      - '/composer.phar'
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/nginx'
      - '/apache2'
      - '/httpd'
  filter_ci_paths:
    Image|startswith:
      - '/opt/ci/'
      - '/srv/gitlab-runner/'
      - '/var/lib/jenkins/'
  condition: selection_image and selection_parent and not filter_ci_paths
falsepositives:
  - Deployment automation that legitimately runs Composer during release tasks
level: high
---
title: Composer Dependency Operation From Writable or Web-Exposed Directory
id: 5a1e7c34-8d29-4b65-a2f0-9c3d1e6b7a41
status: experimental
description: Detects Composer install, update, require, or exec from temporary, upload, or web content directories that often indicate untrusted project handling.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-11689-1-php-composer2-2-10-3-2-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - 'composer install'
      - 'composer update'
      - 'composer require'
      - 'composer exec'
  selection_dirs:
    WorkingDirectory|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/www/'
      - '/srv/www/'
  filter_build_roots:
    WorkingDirectory|startswith:
      - '/opt/build/'
      - '/builds/'
      - '/var/lib/ci/'
  condition: selection_cmd and selection_dirs and not filter_build_roots
falsepositives:
  - Legacy deployment jobs that stage code under web roots
level: medium
---
title: Composer Credential or Repository Material Access on Linux Build Hosts
id: 2f8b5a90-1c7d-4e62-b3a8-6d9f0c2e4b77
status: experimental
description: Detects local reads of Composer auth and configuration artifacts by non-package-management processes on Linux build systems.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-11689-1-php-composer2-2-10-3-2-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/.composer/auth.json'
      - '/composer/auth.json'
      - '/.config/composer/auth.json'
      - '/composer.lock'
  filter_expected:
    Image|endswith:
      - '/composer'
      - '/php'
      - '/git'
  condition: selection_paths and not filter_expected
falsepositives:
  - Backup, EDR, and compliance scanners reading configuration stores
level: medium

let bad_roots = dynamic(['/tmp/','/dev/shm/','/var/www/','/srv/www/']);
let ok_roots = dynamic(['/opt/build/','/builds/','/var/lib/ci/','/opt/ci/','/srv/gitlab-runner/','/var/lib/jenkins/']);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ('composer install','composer update','composer require','composer exec','composer.phar')
| extend Ctx = coalesce(FolderPath, ProcessVersionInfoOriginalFileName, '')
| where InitiatingProcessAccountName in~ ('www-data','nginx','apache','php-fpm') or Ctx has_any (bad_roots)
| where not(Ctx has_any (ok_roots))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath, FileName, SHA256),
(Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ('composer install','composer update','composer require','composer exec','composer.phar')
| where SyslogMessage has_any (bad_roots) or ProcessName in~ ('php-fpm','nginx','apache2','httpd')
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage, SeverityLevel)
| order by TimeGenerated desc

-- Hunt Linux endpoints for unexpected Composer execution and recently touched Composer manifests in risky roots
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'composer (install|update|require|exec|dump-autoload)'
   OR Name =~ '^composer(\.phar)?$'
   OR Exe =~ '/composer(\.phar)?$'

SELECT FullPath, Size, Mtime
FROM glob(globs=['/tmp/**/composer.json','/tmp/**/composer.lock','/dev/shm/**/composer.json','/var/www/**/composer.json','/var/www/**/composer.lock','/srv/www/**/composer.json'])
WHERE Mtime > now() - 604800

# Patch and verify openSUSE php-composer2 for CVE-2026-84361
sudo zypper refresh
sudo zypper --non-interactive patch --cve CVE-2026-84361 || sudo zypper --non-interactive update php-composer2
rpm -q php-composer2 || true
zypper patch-check --cve CVE-2026-84361 || true

# Find recently touched Composer manifests in risky staging and web roots
sudo find /tmp /dev/shm /var/www /srv/www /home -xdev \( -name composer.json -o -name composer.lock \) -mtime -14 -print 2>/dev/null

# Audit unsafe Composer behavior in CI shell history and job scripts
grep -RInE 'composer (install|update|require|exec)|allow-plugins|post-install-cmd|post-update-cmd|COMPOSER_AUTH|auth.json' /opt /srv /var/lib /home 2>/dev/null | head -200

# Reduce execution risk on systems that cannot be rebuilt immediately
sudo composer config --global allow-plugins false 2>/dev/null || true
sudo composer config --global audit.abandoned report 2>/dev/null || true
sudo zypper ps -s || true

Remediation

1. Patch now on applicable openSUSE hosts: run sudo zypper refresh, then sudo zypper patch --cve CVE-2026-84361. If patch mapping is not present on a release, use sudo zypper update php-composer2 and confirm the installed build is php-composer2 2.10.3-2.1 or newer. Official reference: https://linuxsecurity.com/advisories/opensuse/opensuse-2026-11689-1-php-composer2-2-10-3-2-1
2. Verify, do not assume: use rpm -q php-composer2 and zypper patch-check --cve CVE-2026-84361 on every host. Rebuild container images and golden AMIs that embed Composer; package patching a running container does not fix downstream image layers.
3. Prioritize by exposure: first patch internet-reachable CI runners, shared build agents, artifact repositories, and web hosts that deploy PHP. Then patch developer endpoints. A moderate advisory still warrants fast action where Composer consumes untrusted repositories.
4. If patching is temporarily blocked: remove Composer from production runtime servers, run builds only in isolated ephemeral runners, execute Composer with --no-scripts and --no-plugins where compatible, disable allow-plugins unless explicitly required, pin trusted dependencies with reviewed composer.lock files, block egress to unexpected VCS endpoints, and keep Packagist, GitHub, GitLab, and private repo tokens out of shared images.
5. Protect secrets: rotate COMPOSER_AUTH, auth.json contents, private repository tokens, and CI variables if they were present on hosts that processed untrusted PHP projects while unpatched. Scope tokens read-only and per-project.
6. Validate build integrity: after patching, regenerate artifacts from clean sources, compare hashes for release packages, review post-install-cmd and post-update-cmd hooks, and require provenance or signing for internal PHP packages where supported.
7. Deadlines: the provided item includes no CISA due date. Internal SLA recommendation is 24 hours for exposed build infrastructure and 72 hours for remaining installed instances, adjusted if KEV or openSUSE later confirms active exploitation.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub