Backdoor harvested in PHP Git

Attackers hacked the official Git server of the PHP programming language and pushed unauthorised updates to insert a backdoor into the source code.Attackers pushed two commits to the “php-src” repository hosted on the git.php.net server. Investigation is on the line for a supply chain attack

Every connection points towards a compromise of the git.php.net server. Authors decided to stop the hosted infrastructure. The repositories on GitHub, which were previously only mirrors, will become canonical. This means that changes should be pushed directly to GitHub rather than to git.php.net.

The maintainers of the PHP reverted the changes and are reviewing the repositories to detect any other evidence of compromise beyond the two referenced commits.

In order to access the repositories, users will now need to be part of the php organization on GitHub and their account will have 2FA enabled. Adopting this new configuration it is possible to merge pull requests directly from the GitHub web interface.

The analysis of malicious code revealed the presence of a string “Zerodium,” which is the name of one of the most popular zero-day brokers.

Despite the references to Zerodium in the code of the backdoor, there is no evidence to suggest that the malware was designed to be sold as a proof-of-concept (PoC) to the 0day broker.