The Trojan Horse in Your Code - TuxCare

Check the status of CVEs. Learn More.

 CVE Status (opens in new tab)

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

The Trojan Horse in Your Code

Securing Transitive Dependencies and Inherited Risk in Open-Source Software

Why do the most dangerous vulnerabilities live deep in code your team never touched?

Why is the riskiest code in your stack often the least visible – and why don’t teams know what’s actually running in their own dependency trees?

Those are just some of the questions we tackle in The Trojan Horse in Your Code – a practical deep dive into how transitive dependencies and inherited risk actually enter production environments.

In this ebook, we unpack how modern software quietly imports risk through dependency trees, why “just upgrade” often fails in real-world environments, and where hidden exposure tends to live. It’s a sharp, readable guide for anyone who builds with open source (which is… basically everyone), and especially useful for security leaders, platform teams, and engineering orgs inside larger organizations who need to manage risk they didn’t author.

This ebook tackles questions like:
  • How do trusted libraries quietly pull unvetted code into production?
  • Why do vulnerabilities hide deep in dependency trees for years?
  • What actually makes inherited risk so hard to remove safely?
  • Why does “just upgrade” break down in regulated, high-uptime environments?
  • How do ghost dependencies and abstraction layers freeze risk in place?
  • What can teams do when vulnerable code can’t be removed immediately?
and many more!
  • 97% of commercial applications contain open-source code
  • 64% of vulnerabilities live in transitive dependencies teams didn’t directly choose
  • 78% aren’t fully confident about the security of their open-source components (incl. transitive dependencies)

Why should you read this ebook?

You’ll get a grounded look at how inherited risk behaves in real production environments – not theory, not vendor spin. If you’re responsible for open-source risk, platform stability, or long-term modernization, this ebook shows where your hidden attack surface actually forms and how teams contain it without blowing up production.