informa
Quick Hits

Attackers Target PHP Git Server to Backdoor Source Code

The PHP maintainers have decided to make GitHub the official source for PHP repositories going forward.

Attackers have breached the official PHP Git server and infected its code base, PHP developers and maintainers report. They have decided to make GitHub the permanent source for PHP repositories going forward.

Related Content:

4 Open Source Tools to Add to Your Security Arsenal

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: A Day in the Life of a DevSecOps Manager

The attack arrived over the weekend, when two malicious commits were added to the php-src repository from the names of PHP developers Nikita Popov and Rasmus Lerdorf. The commits were disguised as minor typographical corrections that had to be fixed. However, closer analysis revealed their code was designed to install a backdoor for enabling remote code execution on a website running the infected version of PHP, according to Bleeping Computer.

In a blog post published Sunday night, Popov says evidence indicates the PHP server had been compromised.

"We don't yet know how exactly this happened, but everything points towards a compromise of the git.php.net server (rather than a compromise of an individual git account)," he says.

While an investigation is still underway, Popov explains that "we have decided that maintaining our own git infrastructure is an unnecessary security risk." As a result, they will be discontinuing the git.php.net server and all code changes should instead be directly pushed to GitHub. Write access to the PHP repositories was previously handled through a homegrown system called Karma, and the repositories on GitHub had been only mirrors; now, they will become canonical.

"We're reviewing the repositories for any corruption beyond the two referenced commits," Popov says. 

Read more details here.

Recommended Reading: