The PHP core Git repository was compromised, and a bad actor pushed two commits that introduced code injection from an HTTP header to the PHP source and impersonated Nikita Popov and Rasmus Lerdorf.
On the PHP internals mailing list, Nikita said, "We don't yet know how
exactly this happened, but everything points towards a compromise of the
git.php.net server (rather than a compromise of an individual git account)."
At this time, they do not believe any of the code in these commits made it into any builds, but a full investigation is underway. Nikita also said, "we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server."
From now on, the Github repos of the PHP organization will be the official channels for pushing code, but the mailing list will remain for the internals discussions.
Finally, the PHP core team is asking you to please contact firstname.lastname@example.org if you notice anything that could be related to this.