Recommended action

Update phpmyfaq/phpmyfaq to 4.1.4; thorsten/phpmyfaq to 4.1.4 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing affects phpmyfaq/phpmyfaq (composer), thorsten/phpmyfaq (composer). Severity is low. ### Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). ### Details **Affected File** : `phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php` <img width="810" height="427" alt="image" src="https://github.com/user-attachments/assets/6499a008-3ece-4291-8296-f1d3303ba35c" /> ### Impact - An attacker can generate SHA-1 collisions to bypass attachment protection - Risk of password cracking if database is compromised - Estimated cracking time: < 1 minute for standard attachment ### Solution **Use bcrypt:** ``` public function setPassword(string $password): void { $this->passwordHash = password_hash($password, PASSWORD_BCRYPT); } public function verifyPassword(string $plainPassword): bool { return password_verify($plainPassword, $this->passwordHash); } ```

AI coding agents often install or upgrade packages automatically in composer. A low vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update phpmyfaq/phpmyfaq to 4.1.4; thorsten/phpmyfaq to 4.1.4 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing affects phpmyfaq/phpmyfaq (composer), thorsten/phpmyfaq (composer). Severity is low. ### Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). ### Details **Affected File** : `phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php` <img width="810" height="427" alt="image" src="https://github.com/user-attachments/assets/6499a008-3ece-4291-8296-f1d3303ba35c" /> ### Impact - An attacker can generate SHA-1 collisions to bypass attachment protection - Risk of password cracking if database is compromised - Estimated cracking time: < 1 minute for standard attachment ### Solution **Use bcrypt:** ``` public function setPassword(string $password): void { $this->passwordHash = password_hash($password, PASSWORD_BCRYPT); } public function verifyPassword(string $plainPassword): bool { return password_verify($plainPassword, $this->passwordHash); } ```

AI coding agents often install or upgrade packages automatically in composer. A low vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software