Remote Code Execution via web-accessible composer

Composer project reports:

Description: Users publishing a composer.phar to a
public web-accessible server where the composer.phar can
be executed as a php file may be impacted if PHP also has
register_argc_argv enabled in php.ini.
Workaround: Make sure register_argc_argv is disabled
in php.ini, and avoid publishing composer.phar to the web
as this really should not happen.