PHP Internal Git Server Hacked, Backdoor Inserted into Source

[JLX89]

Looks like the current trend of supply chain attacks has hit PHP.

Link to Announcement

[girish]

Looks like they will switch over to GitHub as main repo instead of their current https://git.php.net/ because of the security incident.

[imc67]

@girish interesting analyse:

https://www.wordfence.com/blog/2021/03/php-compromised-what-wordpress-users-need-to-know/

[murgero]

The backdoor was removed before it was compiled into a binary for admins to download so there is no issue for anyone running PHP. However this does prove to be an issues in regards to PHP's safety - They have moved to GitHub (@girish mentions in his reply) and will be better closely monitoring pushes and merges into the code base.

PHP's Own Nikita Popov: "The changes were on the development branch for PHP 8.1, which is due to release at the end of the year" which means the code has not been distributed. It's a big deal but not as big as everyone is making it out to be.

Hopefully this does NOT happen again.