PHP's Official Git Repository Hacked, Backdoor Code Committed

Three days ago, two malicious commits were pushed into the php-src repository maintained by the PHP team on its git.php.net server. Both commits faked signatures — his own, and that of PHP creator Rasmus Lerdorf.

The malicious commit [skip-ci] Fix typo pretends to be a typo fix, submitted under the name rlerdorf, which makes it very easy to mistake for a routine change by a PHP maintainer.

But look at the added line 370, which calls zend_eval_string: that code actually plants a backdoor on any site running this hijacked PHP build, conveniently enabling remote code execution (RCE).

If the string begins with zerodium, this line executes PHP code taken from the useragent HTTP header. Craft a request with a useragent starting with zerodium plus whatever code you want, and you can remotely execute arbitrary PHP sent by the requester. A genuinely dangerous backdoor.

The good news is that the anomalous code was spotted within hours — which goes to show that code review is essential.

PHP Moves from git.php.net to GitHub

The PHP team published an announcement, Changes to Git commit workflow. How those two malicious commits got in is still unknown, but the fault lies with the git.php.net server rather than with a compromised account.

The team concluded that maintaining their own repository infrastructure is unsafe, so they intend to commit directly on GitHub and retire git.php.net.

Here’s my translation of the announcement:

Hi everyone,

Yesterday (2021-03-28), two malicious commits were pushed to the php-src repo under the names of Rasmus Lerdorf and myself. We still don’t know how this happened, but everything points to a compromise of the git.php.net server (rather than of any individual git account).

Although the investigation is ongoing, we’ve decided that maintaining our own git infrastructure is an unnecessary security risk, and so we will be retiring the git.php.net server. Instead, the repositories on GitHub, which were previously just mirrors, will become canonical. This means that changes should be pushed to GitHub rather than to git.php.net.

Whereas write access to the repositories was previously handled by our own karma system, you now need to be part of the php organization on GitHub. If you aren’t part of the organization yet, or don’t have access to repositories that you should have access to, please contact me at nikic@php.net with your php.net and GitHub account names and which permissions you are currently missing. Membership in the organization requires 2FA to be enabled.

This change also means that pull requests can now be merged directly from the GitHub web interface.

We’re reviewing the repositories for any corruption beyond the two referenced commits. If you find any issues, please contact security@php.net.

Regards,

Nikita