• Fixed CWD configuration poisoning vulnerability (CVE-2026-25129). Backported Restricted Mode from v0.12. PsySH now requires explicit trust before loading local config (.psysh.php), local PsySH binaries, or Composer autoloads from untrusted projects. Configure with trustProject config option, --trust-project / --no-trust-project CLI flags, or PSYSH_TRUST_PROJECT env var.