The official PHP Git repository was hacked to add backdoors to the PHP source code; the changes were “reverted right away”
In the latest software supply chain attack, the official PHP Git repository was hacked and the code base tampered with.
Context & Ripple Effects
The PHP incident sits in a broader record of source-control risk: Git had already patched a flaw that let a malicious repository execute code during recursive cloning, while separate Git repositories were wiped and replaced with ransom demands. The distinguishing concern here is unauthorized modification of a widely used project's source, not merely loss of repository availability.
Related coverage later documented compromised developer packages, including a PHP package used to steal developers' cloud credentials, underscoring that the software supply chain can be altered at both repository and dependency layers.
First-order effects
- PHP maintainers must treat the official repository as a compromised distribution point after backdoor code was inserted, even though the changes were reverted quickly.
- Developers and downstream distributors relying on PHP source must verify that no tampered revision entered their build or release process during the exposure window.
Second-order effects
- Repository hosts and open-source maintainers face pressure to tighten controls around source changes, because a reverted commit can still create an integrity-verification burden for downstream users.
- The event makes dependency and source provenance a shared concern: the later compromise of the PHP package phpass shows attackers can target both project repositories and packages consumed by developers.
Third-order effects
- Software delivery is moving toward a control-plane model in which the trustworthiness of repository access, commit review, and artifact provenance matters as much as the code itself.
- If repository compromises and package tampering continue to recur, downstream organizations will increasingly need independent verification of the source they build rather than treating an official repository as sufficient proof of integrity.
The trend: Open-source supply-chain security is shifting from protecting code hosting alone to verifying every handoff from repository commit to developer-consumed artifact.