GCVE-110-OSM-2026-4650

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published May 23, 2026

GitHub repository https://github.com/Laravel-Lang/attributes was compromised via Laravel-Lang organization takeover. Attackers force-pushed roughly 700+ historical tags across the 12.x-15.x version lines with a backdoored src/helpers.php that fetches a second-stage credential harvester from flipboxstudio.info. The Laravel-Lang GitHub organization was compromised. Attackers rewrote and force-pushed historical tags across these repositories, injecting a backdoored src/helpers.php loaded via composer.json autoload.files. Tags were republished seconds apart across hundreds of historical versions. Initial backdoor contacts: https://flipboxstudio.info/payload Exfil endpoint: https://flipboxstudio.info/exfil XOR encryption key: k9X2mP7vL4nQ8wR1

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown		all (affected)	—

References

Malicious package:

advisory

Browse GCVE Records

73,040 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON