Nils Adermann and Jordi Boggiano, the creators of Composer and co-founders of Private Packagist, will share what a year of supply chain attacks taught them at SymfonyCon Warsaw 2026. Their talk, "The Attack Reached PHP: Composer and Packagist, One Year On," walks through how the tools you install every package with have changed in response.

A year ago, at SymfonyCon 2025, the two laid out a long-term plan for supply chain security. They didn't get the long term. Here is how the talk description puts it:

At SymfonyCon 2025 we outlined a long-term supply chain security strategy. Reality caught up faster than expected. The PHP ecosystem was hit by the same class of attack that has repeatedly hit npm and PyPI: hijacked GitHub accounts and stolen access tokens, used to publish malicious tags on packages the attackers never owned.

Detection Came First

The first changes were about seeing the problem. Packagist.org now pulls in the Aikido malware feed, and a public transparency log gave people outside the project the data they needed to analyze what happened.

Then Prevention

With detection in place, the focus moved to stopping bad releases from reaching your vendor/ directory. The changes they'll cover include:

  • Composer 2.10's unified dependency policy, one place to handle malware, security advisories, and abandoned packages.
  • Immutable stable releases, so a tag can no longer be silently rewritten. That closes the exact hole the attackers used.
  • Composer 2.11's minimum-release-age setting, which lets you hold back versions until they've been public for a while.
  • Published MFA status for package maintainers.
  • Organization-level ownership controls on Packagist.

The talk also promises concrete practices for hardening your own supply chain, and a look at where Composer and Packagist are headed in 2027. If you want scanning on your own projects in the meantime, Socket added PHP and Composer support in August.

Event Details

  • Dates: November 26-27, 2026
  • Location: Warsaw, Poland
  • Format: Two days, three parallel tracks
  • Hackday: Saturday, November 28, free and open to all
  • Schedule: live.symfony.com

Read the full announcement on the Symfony blog, and grab a ticket from the registration page if you want to hear it in person.