The official PHP Git repository was hacked, adding a backdoor RCE to the PHP source code; PHP maintainer says the changes were reverted within a few hours
This commit does not belong to any branch on this repository … Mark Sullivan / Fast Company : Hackers put a back door in a code library that powers 79% of websites Tweets: Sam Kottler / @samkottler : The PHP project is moving to GitHub after their Git infrastructure was exploited to push two malicious commits - https://news-web.php.net/... @malwaretechblog : Hahahaha. My guess is someone compromised one of the php contributors, tries to sell the access to Zerodium, then got mad and did this when they wouldn't buy it. https://twitter.com/... https://twitter.com/... John Regehr / @johnregehr : brazen attempt to insert backdoor with commit messages “Fix typo” 🤣 https://news-web.php.net/... https://twitter.com/... @malwaretechblog : @pwnallthethings hmm yeah, according to the mailing list they think the server itself got owned https://news-web.php.net/... Artem Russakovskii / @artemr : PHP's source code git repo was compromised over the weekend and added a backdoor RCE. https://news-web.php.net/... A good write-up on the hack https://www.wordfence.com/.... Hamid K / @hkashfi : Somebody was too bored and lazy to find an RCE in their target's PHP application within a day or two, so they went ahead and backdoored the PHP itself instead :> “sold to zerodium in 2017” ?! Nice prank. https://github.com/... PHP Community / @phpc : Congrats to the internals team who moved quickly to revert these commits and mitigate the risk of future malicious commits to the official php-src repository! https://www.bleepingcomputer.com/ ... @j0hnnyxm4s : I think the biggest issue with “supply chain attacks” is folks who think this vector doesn't apply to them because they don't work in manufacturing. https://www.bleepingcomputer.com/ ... @spazef0rze : PHP source starts using GitHub as a main repository (previously a mirror only) after the zlib extension has been backdoored on Sunday, pointing to a internal git server (not GitHub) compromise. https://therecord.media/... by @campuscodi Sean Kerner / @techjournalist : Considering how ....slooooowly.. many sites move to new versions as most stick with older versions of PHP (PHP 5.x is all over the place) / this isn't nearly as bad as it could have been https://twitter.com/... Binni Shah / @binitamshah : Malicious commits made to PHP project on https://git.php.net/ to allow RCE, project moved to https://github.com/ : https://news-web.php.net/... Lukasz Olejnik / @lukolejnik : Development servers of PHP compromised. PHP repository itself, too. “maintaining our own git infrastructure is an unnecessary security risk” https://news-web.php.net/... https://twitter.com/...
Context & Ripple Effects
The malicious commits were removed within hours, but PHP followed the incident by moving its main source repository to GitHub. The episode is a repository-control failure rather than a flaw in PHP's released code alone; an earlier Git cloning vulnerability capable of code execution had already shown how source-control workflows can become an attack path.
The related coverage also places this alongside later package compromises that targeted developer credentials, including the compromised phpass package. Together, they make the integrity of code publication and dependency channels a central security boundary for the PHP community.
First-order effects
- PHP maintainers shifted the project's main source repository to GitHub after removing the backdoored zlib-extension commits, changing the control plane used to publish php-src.
- PHP users and downstream distributors had to treat the brief window of malicious repository history as a source-integrity incident, even though maintainers reverted the changes quickly.
Second-order effects
- GitHub becomes the immediate custodian of PHP's primary source-hosting workflow, concentrating trust in the platform's access controls and commit-review processes.
- Maintainers of PHP packages and downstream builds face greater pressure to verify source provenance, because a compromise of an official repository can reach consumers before a malicious change is identified.
Third-order effects
- Software supply-chain security is shifting from protecting source code alone to protecting the repositories, credentials, and publication paths that authorize it.
- If repository compromises continue to overlap with dependency compromises, projects will increasingly distinguish trusted releases from merely available source history through stronger provenance controls.
The trend: The incident is part of a broader shift toward treating the software-delivery control plane—repository access, commits, and release provenance—as a primary security perimeter.