The Perforce Driver You Never Knew You Had: Composer CVE-2026-40261 and CVE-2026-40176
Two command injection vulnerabilities in Composer’s Perforce driver are exploitable even if you’ve never touched Perforce. For Magento shops running dev dependencies from source, CVE-2026-40261 is a supply-chain exposure hiding …