GCVE-110-OSM-2026-591

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published May 23, 2026

GitHub repository https://github.com/Laravel-Lang/http-statuses was compromised via Laravel-Lang organization takeover. Attackers force-pushed roughly 700+ historical tags across the 12.x-15.x version lines with a backdoored src/helpers.php that fetches a second-stage credential harvester from flipboxstudio.info. The Laravel-Lang GitHub organization was compromised. Attackers rewrote and force-pushed historical tags across these repositories, injecting a backdoored src/helpers.php loaded via composer.json autoload.files. Tags were republished seconds apart across hundreds of historical versions. Initial backdoor contacts: https://flipboxstudio.info/payload Exfil endpoint: https://flipboxstudio.info/exfil XOR encryption key: k9X2mP7vL4nQ8wR1

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	nemo-fpti	all (affected), all (affected)	—
unknown	transitive_lib	all (affected), all (affected), all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), * (affected)	—
unknown	yelp-react-component-rating	all (affected), all (affected), all (affected), * (affected)	—
unknown		all (affected), all (affected)	—