Socket: PHP and Composer Support Reaches Beta With Reachability Analysis

What it is

Socket's PHP/Composer supply-chain scanning moved from Experimental to Beta for all customers, and PHP reachability analysis is now generally available. The summary covers the attack catalog; what it omits is the concrete shape of the reachability feature, its measured hit rates, and a plan-tier gate that determines whether you can actually use it.

How it works

Reachability separates vulnerabilities an application can invoke from those it cannot. Socket offers two tiers:

• Precomputed Reachability — analyzes function calls within the dependency graph, working from Composer manifests alone (no source-code access or config). Flags ~60% of vulnerabilities in transitive dependencies as irrelevant.
• Full Application Reachability — analyzes application source and dependency code, showing whether a vulnerable function is reachable and the call path to it. Eliminates up to 90% of false positives.

The engine handles PHP patterns that defeat naive static analysis: magic-method dispatch via __call, dynamically instantiated classes, and string-keyed service containers used by Laravel and Symfony.

Base scanning reads both composer.lock and composer.json to resolve direct and transitive trees, generates SBOMs (with or without a lockfile), does CVE detection with CISA KEV / CWE / EPSS context, separates dev dependencies, and supports repos containing multiple Composer projects.

Preconditions / Affected

• Beta scanning: available to all Socket customers, no Experimental access needed.
• Reachability analysis: gated to the Team plan tier and higher. This is the operative constraint — if you're below Team, the headline feature is unavailable.
• Full Application Reachability requires access to your application source; Precomputed does not.

What to do

If you run PHP/Composer projects and already have Socket, reachability is on without requesting Experimental access — but confirm your plan is Team or above. Decide between Precomputed (manifest-only, lower ceiling) and Full Application (needs source, higher false-positive reduction) based on whether you can grant source access. The page states no commands or config steps.

Caveats

The 60% and 90% figures are vendor-reported reduction rates, not independently verified here. Precomputed's ceiling is lower by design because it never sees your application code — a vulnerability flagged irrelevant by Precomputed is inferred from the graph, not confirmed against your call sites. The referenced Guzzle walkthrough and the prior technical overview live on separate pages not included here.