Risk
10/27/2013
08:16 AM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

Breach At PHP.net Causes Site To Serve Malware

Popular PHP.net developer site distributed malware after experiencing server security breaches

PHP.net, one of the Web's most popular application development sites, was breached last week, causing it to serve malware to a number of its users.

In a series of blogs issued Thursday, the operators of PHP.net disclosed that two of the site's servers had been compromised. The operators say they still don't know how the breach happened.

The blogs were posted shortly after researchers at Barracuda Labs, Google, AlienVault, and Websense reported JavaScript malware emanating from PHP.net Web servers. PHP.net says that the malware was served "to a small percentage of PHP.net users" from Oct. 22 to Oct. 24.

"All affected services have been migrated off those servers," PHP.net says in its latest blog. "We have verified that our Git repository was not compromised, and it remains in read only mode as services are brought back up in full.

"As it's possible that the attackers may have accessed the private key of the php.net SSL certificate, we have revoked it immediately," the blog says. The site has gotten a new certificate and has restored access to PHP.net sites that require SSL.

All PHP.net users will have their passwords reset in the next few days, the blog says. Users of PHP software "are unaffected by this: this is solely for people committing code to projects hosted on svn.php.net or git.php.net," the organization states.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0121
Published: 2015-05-30
IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation (RDNG) 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management (RM) session upon LTPA token ...

CVE-2015-0191
Published: 2015-05-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0191. Reason: This candidate is a duplicate of CVE-2014-0191. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-0191 instead of this candidate. All references and descriptions in this candid...

CVE-2015-0193
Published: 2015-05-30
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0733
Published: 2015-05-30
CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID ...

CVE-2015-0743
Published: 2015-05-30
Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?