chore(deps): update dependency phpunit/phpunit to v8 [security]

[renovate-fastnorth]

This PR contains the following updates:

Package	Change	Age	Confidence
phpunit/phpunit	^5.3 → ^8.5.52

---

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

CVE-2026-24765 / GHSA-vvj3-c3rp-c85p

More information

Details

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @​unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

• CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
• Local Development Environment: An attacker with shell access or ability to write files to the project directory
• Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
   • A malicious actor placed it intentionally
   • Build artifacts from a previous run contaminated the environment
   • An unexpected filesystem state requiring investigation
3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
   • Isolate CI/CD runners (ephemeral, containerized environments)
   • Restrict code execution on protected branches
   • Scan pull requests and artifacts for tampering
   • Use branch protection rules to prevent unreviewed code execution

Severity Classification

• Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
• Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
• Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
• User Interaction (UI): None (N) — automatic execution during standard test execution
• Scope (S): Unchanged (U) — impact remains within the affected test execution context
• Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
• Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
• Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

• Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
• Code Review Enforcement: Require human review and approval before executing code from pull requests
• Branch Protection: Enforce branch protection rules that block unreviewed code execution
• Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
• Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

• Visibility: The error appears prominently in CI/CD output and test logs
• Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
• Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

• Pull requests from forks or untrusted sources execute in isolated environments
• Branch protection rules require human review before code execution
• CI/CD runners are ephemeral and discarded after each build
• Build artifacts are not reused across independent runs without validation

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
• https://github.com/sebastianbergmann/phpunit/commit/613d142f5a8471ca71623ce5ca2795f79248329e
• https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
• https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
• https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
• https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
• https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
• https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution
• https://nvd.nist.gov/vuln/detail/CVE-2026-24765
• https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
• https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-24765.yaml
• https://github.com/advisories/GHSA-vvj3-c3rp-c85p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Code Injection in PHPUnit

CVE-2017-9841 / GHSA-r7c9-c69m-rph8

More information

Details

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-9841
• https://github.com/sebastianbergmann/phpunit/pull/1955
• https://github.com/sebastianbergmann/phpunit/pull/1956
• https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
• https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml
• https://github.com/sebastianbergmann/phpunit
• https://security.gentoo.org/glsa/201711-15
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841
• https://www.oracle.com/security-alerts/cpuoct2021.html
• http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com
• http://www.securityfocus.com/bid/101798
• http://www.securitytracker.com/id/1039812

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

CVE-2026-24765 / GHSA-vvj3-c3rp-c85p

More information

Details

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @​unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

• CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
• Local Development Environment: An attacker with shell access or ability to write files to the project directory
• Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
   • A malicious actor placed it intentionally
   • Build artifacts from a previous run contaminated the environment
   • An unexpected filesystem state requiring investigation
3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
   • Isolate CI/CD runners (ephemeral, containerized environments)
   • Restrict code execution on protected branches
   • Scan pull requests and artifacts for tampering
   • Use branch protection rules to prevent unreviewed code execution

Severity Classification

• Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
• Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
• Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
• User Interaction (UI): None (N) — automatic execution during standard test execution
• Scope (S): Unchanged (U) — impact remains within the affected test execution context
• Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
• Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
• Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

• Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
• Code Review Enforcement: Require human review and approval before executing code from pull requests
• Branch Protection: Enforce branch protection rules that block unreviewed code execution
• Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
• Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

• Visibility: The error appears prominently in CI/CD output and test logs
• Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
• Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

• Pull requests from forks or untrusted sources execute in isolated environments
• Branch protection rules require human review before code execution
• CI/CD runners are ephemeral and discarded after each build
• Build artifacts are not reused across independent runs without validation

Severity

• CVSS Score: 7.8 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
• https://nvd.nist.gov/vuln/detail/CVE-2026-24765
• https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
• https://github.com/sebastianbergmann/phpunit/commit/613d142f5a8471ca71623ce5ca2795f79248329e
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-24765.yaml
• https://github.com/sebastianbergmann/phpunit
• https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
• https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
• https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
• https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
• https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
• https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
• https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[carcunha]

Blocked — dev-only bump with no verification path.

• phpunit/phpunit ^5.3 → ^13 is a major test-suite migration, not a constraint-only change.
• Security label applies to require-dev; this does not affect runtime consumers.
• This repo has no CI workflow — nothing validates the bump (no checks on this PR).

Run and fix the test suite locally before merging, or close if PHPUnit 5 tests are no longer maintained.

[cursor]

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.