Attackers Target PHP Git Server to Backdoor Source CodeAttackers Target PHP Git Server to Backdoor Source Code
The PHP maintainers have decided to make GitHub the official source for PHP repositories going forward.
March 30, 2021
Attackers have breached the official PHP Git server and infected its code base, PHP developers and maintainers report. They have decided to make GitHub the permanent source for PHP repositories going forward.
The attack arrived over the weekend, when two malicious commits were added to the php-src repository from the names of PHP developers Nikita Popov and Rasmus Lerdorf. The commits were disguised as minor typographical corrections that had to be fixed. However, closer analysis revealed their code was designed to install a backdoor for enabling remote code execution on a website running the infected version of PHP, according to Bleeping Computer.
In a blog post published Sunday night, Popov says evidence indicates the PHP server had been compromised.
"We don't yet know how exactly this happened, but everything points towards a compromise of the git.php.net server (rather than a compromise of an individual git account)," he says.
While an investigation is still underway, Popov explains that "we have decided that maintaining our own git infrastructure is an unnecessary security risk." As a result, they will be discontinuing the git.php.net server and all code changes should instead be directly pushed to GitHub. Write access to the PHP repositories was previously handled through a homegrown system called Karma, and the repositories on GitHub had been only mirrors; now, they will become canonical.
"We're reviewing the repositories for any corruption beyond the two referenced commits," Popov says.
Read more details here.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
2022 Insurance Industry Cyber Threat Landscape Report
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report
Managed Security and the 3rd Party Cyber Risk Opportunity Whitepaper