A high-severity deserialization vulnerability in PHPUnit allows local attackers to execute arbitrary code during test runs, posing a significant risk to CI/CD pipelines and developer environments.

This flaw involves the unsafe deserialization of code coverage data within the cleanupForCoverage() method. An attacker with local file write access can place a malicious serialized object that triggers execution during PHPUnit test runs, requiring low privileges to exploit.

Successful exploitation can lead to a complete compromise of the build server or development machine, as arbitrary code execution occurs with the privileges of the user running the tests. Given the CVSS score of 7.8, this vulnerability represents a high risk to supply chain integrity, potentially facilitating the injection of malicious code into software artifacts during the build process.

Immediate Action: Update PHPUnit to versions 8.5.52, 9.6.33, 10.5.62, 11.5.50, or 12.5.8, depending on your current major version, to include the necessary deserialization protections.

Proactive Monitoring: Monitor CI/CD pipeline execution logs for unauthorized file modifications or unexpected process spawning during the testing phase.

Compensating Controls: Restrict write access to the directories where PHPUnit expects coverage files to prevent unauthorized placement of malicious data. Ensure that CI/CD pipelines run with the principle of least privilege to contain potential post-exploitation activity.

Public Exploit Available: Unknown

This vulnerability presents a clear path to remote code execution in environments relying on PHPUnit for automated testing. Organizations should prioritize updating their testing frameworks immediately to prevent build-time attacks. If immediate patching is not feasible, restrict the environment variables and filesystem access available to the test execution process to minimize the attack surface.