The PHP core Git repository was compromised, and a bad actor pushed two commits that introduced code injection from an HTTP header to the PHP source and impersonated Nikita Popov and Rasmus Lerdorf.
On the PHP internals mailing list, Nikita said, "We don't yet know how exactly this happened, but everything points towards a compromise of the git.php.net server (rather than a compromise of an individual git account)."
You can see the two (1 2) commits in question from the mirrored Github repo.
At this time, they do not believe any of the code in these commits made it into any builds, but a full investigation is underway. Nikita also said, "we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server."
From now on, the Github repos of the PHP organization will be the official channels for pushing code, but the mailing list will remain for the internals discussions.
Finally, the PHP core team is asking you to please contact security@php.net if you notice anything that could be related to this.
