Greg Beaver has an advisory message posted on his blog today about why it's imporatant to upgrade PEAR from 1.3.x to the latest, 1.4.6.
PEAR 1.4.6 was just released at pear.php.net (http://pear.php.net/PEAR). This is a minor bugfix release and complete details are available at pear.php.net, but I must stress two points with extreme seriousness:
He goes on to discuss further why that second point is particularly dangerous, including several unpublished serious bugs. You can download the latest PEAR packages from the main PEAR site...