PHP's Git Server Compromised and Malicious Code Pushed to the Source


March 29th, 2021


The PHP core Git repository was compromised, and a bad actor pushed two commits that introduced code injection from an HTTP header to the PHP source and impersonated Nikita Popov and Rasmus Lerdorf.

On the PHP internals mailing list, Nikita said, "We don't yet know how
exactly this happened, but everything points towards a compromise of the server (rather than a compromise of an individual git account)."

You can see the two (1 2) commits in question from the mirrored Github repo.

At this time, they do not believe any of the code in these commits made it into any builds, but a full investigation is underway. Nikita also said, "we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the server."

From now on, the Github repos of the PHP organization will be the official channels for pushing code, but the mailing list will remain for the internals discussions.

Finally, the PHP core team is asking you to please contact if you notice anything that could be related to this.

Filed in:

Eric L. Barnes

Eric is the creator of Laravel News and has been covering Laravel since 2012.

Laravel News Partners