Supply-chain attack backdoored 700+ Laravel Lang package versions

A widely used community PHP translation ecosystem was compromised across hundreds of historical releases with a remote-code-execution backdoor

Supply chain attack on the Laravel Lang organization: 700+ historical versions across multiple community-maintained Laravel Lang packages were compromised with an RCE backdoor, including: laravel-lang/lang laravel-lang/http-statuses la
Ranked #1 on backlist 2026-05-23 (23 May 2026 UTC) · by (Socket) ·

How it ranks: Backlist reads my Twitter/X timeline, scores every tweet for substance with an LLM rubric (not engagement), and publishes the daily top picks with a one-line takeaway. Curated by Surya Dantuluri.