Update PHPUnit to 9.6.33 to fix unsafe deserialization vulnerability by Copilot · Pull Request #880 · Adyen/adyen-php-api-library

Copilot · 2026-01-28T07:53:13Z

PHPUnit ≤ 9.6.32 contains a vulnerability where .coverage files are deserialized without validation in PHPT test execution, enabling arbitrary code execution if an attacker can write malicious coverage files to the filesystem (e.g., via CI/CD pull requests).

Fix https://github.com/Adyen/adyen-php-api-library/security/dependabot/6

Changes

Bump phpunit/phpunit from 9.6.31 to 9.6.33 in composer.json

- "phpunit/phpunit": "9.6.31",
+ "phpunit/phpunit": "9.6.33",

The patched version treats pre-existing .coverage files as an error condition rather than silently deserializing them, making any anomalous state visible in CI/CD output.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/50895a07cface1385082e4caa6a6786c4e033468
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/86e5f5dd9a840c46810ebe5ff1885581c42a3017
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/clue/reactphp-ndjson/zipball/392dc165fce93b5bb5c637b67e59619223c931b0
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/composer/pcre/zipball/b2bed4734f0cc156ee1fe9c0da2550420d99a21e
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/composer/semver/zipball/198166618906cb2de69b95d7d47e5fa8aa1b2b95
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/composer/xdebug-handler/zipball/6c1925561632e83d60a44492e0b344cf48ab85ef
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/doctrine/instantiator/zipball/c6222283fa3f4ac679f8b9ced9a4e23f163e80d0
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/guzzle/guzzle/zipball/b51ac707cfa420b7bfd4e4d5e510ba8008e822b4
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/guzzle/promises/zipball/481557b130ef3790cf82b713667b43030dc9c957
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/guzzle/psr7/zipball/21dc724a0583619cd1652f673303492272778051
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/igorw/evenement/zipball/0a16b0d71ab13284339abb99d9d2bd813640efbc
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/nikic/PHP-Parser/zipball/dca41cd15c2ac9d055ad70dbfd011130757d1f82
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/phar-io/manifest/zipball/54750ef60c58e43759730615a392c31c80e23176
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-coveralls/php-coveralls/zipball/b36fa4394e519dafaddc04ae03976bc65a25ba15
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-fig/container/zipball/c71ecc56dfe541dbd90c5360474fbc405f8d5963
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-fig/event-dispatcher/zipball/dbefd12671e8a14ec7f180cab83036ed26714bb0
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-fig/http-client/zipball/bb5906edc1c324c9a05aa0873d40117941e5fa90
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-fig/http-factory/zipball/2b4765fddfe3b508ac62f829e852b1501d3f6e8a
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-fig/http-message/zipball/402d35bcb92c70c026d1a6a9883f06b2ead23d71
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/php-fig/log/zipball/ef29f6d262798707a9edd554e2b82517ef3a9376
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/ralouphie/getallheaders/zipball/120b605dfeb996808c31b6477290a714d356e822
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/rdohms/phpunit-arraysubset-asserts/zipball/aa6b9e858414e91cca361cac3b2035ee57d212e0
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/cache/zipball/d47c472b64aa5608225f47965a484b75c7817d5b
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/child-process/zipball/970f0e71945556422ee4570ccbabaedc3cf04ad3
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/dns/zipball/7562c05391f42701c1fccf189c8225fece1cd7c3
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/event-loop/zipball/ba276bda6083df7e0050fd9b33f66ad7a4ac747a
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/promise/zipball/23444f53a813a3296c1368bb104793ce8d88f04a
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/socket/zipball/ef5b17b81f6f60504c539313f94f2d826c5faa08
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/reactphp/stream/zipball/1e5b0acb8fe55143b5b426817155190eb6f5b18d
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/cli-parser/zipball/2b56bea83a09de3ac06bb18b92f068e60cc6f50b
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/ac91f01ccec49fb77bdc6fd1e548bc70f7faa3e5
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/code-unit/zipball/1fc9f64c0927627ef78ba436c9b17d967e68e120
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/complexity/zipball/25f207c40d62b8b7aa32f5ab026c53561964053a
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/global-state/zipball/b6781316bdcd28260904e7cc18ec983d0d2ef4f6
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/e1e4a170560925c26d424b6a03aed157e7dcc5c5
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/5c9eeac41b290a3712d88851518825ad78f45c71
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/object-reflector/zipball/b4f479ebdbf63ac605d183ece17d8d7fe49c15c7
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/85402a822d1ecf1db1096959413d35e1c37cf1a5
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/cf1c2e7c203ac650e352f4cc675a7021e7d1b3cf
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-invoker/zipball/5a10147d0aaf65b58940a0b72f71c9ac0423cc67
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/5da5f67fc95621df9ff4c4e5a84d6a8a2acf7c28
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/php-timer/zipball/5a63ce20ed1b5bf577850e2c4e87f4aa902afbd2
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/phpunit/zipball/fea06253ecc0a32faf787bd31b261f56f351d049
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/539c6691e0623af6dc6f9c20384c120f963465a0
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/resource-operations/zipball/05d5692a7993ecccd56a03e40cd7e5b09b1d404e
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/type/zipball/75e2c2a32f5e0b3aef905b9ed0b179b953b3d7c7
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/sebastianbergmann/version/zipball/c6c1022351a901512170118436c764e473f6de8c
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/TkWzhi /usr/bin/composer update (http block)
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/config/zipball/4275b53b8ab0cf37f48bf273dc2285c8178efdfb
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/console/zipball/41e38717ac1dd7a46b6bda7d6a82af2d98a78894
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/deprecation-contracts/zipball/63afe740e99a13ba87ec199bb07bbdee937a5b62
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/event-dispatcher-contracts/zipball/59eb412e93815df44f05f342958efa9f46b1e586
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/event-dispatcher/zipball/dc2c0eba1af673e736bb851d747d266108aea746
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/filesystem/zipball/d551b38811096d0be9c4691d406991b47c0c630a
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/finder/zipball/01b24a145bbeaa7141e75887ec904c34a6728a5f
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/options-resolver/zipball/b38026df55197f9e39a44f3215788edf83187b80
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-ctype/zipball/a3cc8b044a6ea513310cbd48ef7333b384945638
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/380872130d3a5dd3ace2f4010d95125fde5d5c70
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-intl-normalizer/zipball/3833d7255cc303546435cb650316bff708a1c75c
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-mbstring/zipball/6d857f4d76bd4b343eac26d6b539585d2bc56493
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-php80/zipball/0cc9dd0f17f61d8131e7df6b84bd344899fe2608
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-php81/zipball/4a4cfc2d253c21a5ad0e53071df248ed48c6ce5c
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/polyfill-php84/zipball/d8ced4d875142b6a7426000426b8abc631d6b191
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/process/zipball/626f07a53f4b4e2f00e11824cc29f928d797783b
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/service-contracts/zipball/45112560a3ba2d715666a509a0bc9521d10b6c43
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/stopwatch/zipball/8a24af0a2e8a872fb745047180649b8418303084
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/string/zipball/1c4b10461bf2ec27537b5f36105337262f5f5d6f
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/symfony/yaml/zipball/24dd4de28d2e3988b311751ac49e684d783e2345
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/theofidry/cpu-core-counter/zipball/db9508f7b1474469d9d3c53b86f817e344732678
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
https://api.github.com/repos/theseer/tokenizer/zipball/b7489ce515e168639d17feec34b8847c326b0b3c
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/fiIqC3 /usr/bin/composer update --no-interaction (http block)
out.adyen.com
- Triggering command: /usr/bin/php php vendor/bin/phpunit --testsuite unit --stop-on-failure exec 'git' 'remote' 'add' 'compoREDACTED /https---github.com-clue-reactphp-ndjson.git/ library/adyen-php-api-library/vendor/clue/ndjson-react /vcs/https---gitgit-upload-pack 5666a509a0bc9521/home/REDACTED/.cache/composer/vcs/https---github.com-php-coveralls-ph�� /https---github.com-clue-reactph2.8.0 git chec�� guzzle/guzzle.git' che/composer/vcs/https---github.com-php-fig-log.git/ k/adyen-php-api-library/adyen-php-api-library/vendor/psr/log .com:symfony/congit CS-Fixer.git che/composer/vcs-r git (dns block)
outgoing1.adyen.com
- Triggering command: /usr/bin/php php vendor/bin/phpunit --testsuite unit --stop-on-failure exec 'git' 'remote' 'add' 'compoREDACTED /https---github.com-clue-reactphp-ndjson.git/ library/adyen-php-api-library/vendor/clue/ndjson-react /vcs/https---gitgit-upload-pack 5666a509a0bc9521/home/REDACTED/.cache/composer/vcs/https---github.com-php-coveralls-ph�� /https---github.com-clue-reactph2.8.0 git chec�� guzzle/guzzle.git' che/composer/vcs/https---github.com-php-fig-log.git/ k/adyen-php-api-library/adyen-php-api-library/vendor/psr/log .com:symfony/congit CS-Fixer.git che/composer/vcs-r git (dns block)
outgoing2.adyen.com
- Triggering command: /usr/bin/php php vendor/bin/phpunit --testsuite unit --stop-on-failure exec 'git' 'remote' 'add' 'compoREDACTED /https---github.com-clue-reactphp-ndjson.git/ library/adyen-php-api-library/vendor/clue/ndjson-react /vcs/https---gitgit-upload-pack 5666a509a0bc9521/home/REDACTED/.cache/composer/vcs/https---github.com-php-coveralls-ph�� /https---github.com-clue-reactph2.8.0 git chec�� guzzle/guzzle.git' che/composer/vcs/https---github.com-php-fig-log.git/ k/adyen-php-api-library/adyen-php-api-library/vendor/psr/log .com:symfony/congit CS-Fixer.git che/composer/vcs-r git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>[Bug]: PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling</issue_title>
<issue_description>### Description

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Steps to reproduce

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
Local Development Environment: An attacker with shell access or ability to write files to the project directory
Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo
Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:
Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
A malicious actor placed it intentionally
Build artifacts from a previous run contaminated the environment
An unexpected filesystem state requiring investigation
Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
Isolate CI/CD runners (ephemeral, containerized environments)
Restrict code execution on protected branches
Scan pull requests and artifacts for tampering
Use branch protection rules to prevent unreviewed code execution
Severity Classification
Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
User Interaction (UI): None (N) — automatic execution during standard test execution
Scope (S): Unchanged (U) — impact remains within the affected test execution context
Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
Availability Impact (A): High (H) — full code execution permits denial-of-service actions
Mitigating Factors (Environmental Context)
Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
Code Review Enforcement: Require human review and approval before executing code from pull requests
Branch Protection: Enforce branch protection rules that block unreviewed code execution
Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
Access Control: Limit file write permissions in CI...

Fixes [Bug]: PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling #879

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: gcatanese <1771700+gcatanese@users.noreply.github.com>

sonarqubecloud · 2026-01-28T08:04:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Initial plan

6e53614

Copilot AI assigned Copilot and gcatanese Jan 28, 2026

Copilot started work on behalf of gcatanese January 28, 2026 07:53 View session

Update PHPUnit from 9.6.31 to 9.6.33 to fix security vulnerability

bfcdb55

Co-authored-by: gcatanese <1771700+gcatanese@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix PHPUnit vulnerability in PHPT code coverage handling~~ Update PHPUnit to 9.6.33 to fix unsafe deserialization vulnerability Jan 28, 2026

Copilot AI requested a review from gcatanese January 28, 2026 08:02

Copilot finished work on behalf of gcatanese January 28, 2026 08:02

gcatanese marked this pull request as ready for review January 28, 2026 10:14

gcatanese requested review from a team as code owners January 28, 2026 10:14

gcatanese enabled auto-merge January 28, 2026 10:16

gcatanese requested a review from jeandersonbc January 28, 2026 10:16

jeandersonbc approved these changes Jan 28, 2026

View reviewed changes

gcatanese added this pull request to the merge queue Jan 28, 2026

Merged via the queue into main with commit 9cce0bb Jan 28, 2026
9 checks passed

gcatanese deleted the copilot/fix-phpunit-unsafe-deserialization branch January 28, 2026 14:35

AdyenAutomationBot mentioned this pull request Jan 28, 2026

Release v29.0.0 #837

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update PHPUnit to 9.6.33 to fix unsafe deserialization vulnerability#880

Update PHPUnit to 9.6.33 to fix unsafe deserialization vulnerability#880
gcatanese merged 2 commits intomainfrom
copilot/fix-phpunit-unsafe-deserialization

Copilot AI commented Jan 28, 2026 •

edited by gcatanese

Loading

Uh oh!

sonarqubecloud bot commented Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Jan 28, 2026 • edited by gcatanese Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Steps to reproduce

Technical Details

Attack Prerequisites and Constraints

Proposed Remediation Approach

Uh oh!

sonarqubecloud bot commented Jan 28, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 28, 2026 •

edited by gcatanese

Loading