At SymfonyCon 2025 we outlined a long-term supply chain security strategy. Reality caught up faster than expected. The PHP ecosystem was hit by the same class of attack that has repeatedly hit npm and PyPI: hijacked GitHub accounts and stolen access tokens, used to publish malicious tags on packages the attackers never owned.

This talk covers what we changed in response. Detection first: the Aikido malware feed integrated into Packagist.org, and a public transparency log that made analysis possible. Then prevention: Composer 2.10's unified dependency policy for malware, advisories and abandoned packages; immutable stable releases so tags can no longer be silently rewritten; Composer 2.11's minimum-release-age setting; published MFA status for maintainers; organization-level ownership controls.

You'll get concrete practices for hardening your own supply chain, and where we're taking this in 2027.