Poisoned Pipeline / Incidents / AS152

AS152 · 2026-05

Laravel Lang RCE backdoor across 700+ versions

Packagist / Composer

Socket: Laravel Lang compromised with an RCE backdoor across 700+
versions.

Mapped techniques

• T0121 Compromised legitimate artifact
• T0118 Command injection

supply-chain campaign

Sources

• https://socket.dev/blog/laravel-lang-compromise