Someone just tried to add a security backdoor in the PHP language

By Mayank Sharma
published

PHP has immediately moved their developed to GitHub

html code
(Image credit: Pixabay)

Two malicious changes were made to the development branch of the upcoming PHP v8.1 (opens in new tab) in an attempt to add a backdoor to any website that runs this tainted version of the popular web development (opens in new tab) language.

While the objectionable code was caught and removed within a few hours, given the fact that PHP powers almost 80% of all websites (opens in new tab) on the Internet, the PHP developers have made some key infrastructural changes while they investigate the incident.

“While investigation is still underway, we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server,” shared PHP maintainer (opens in new tab) Nikita Popov.

TechRadar needs yo...

We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.

>> Click here to start the survey in a new window (opens in new tab)<<

Ramping up security

The threat actors made the two code changes in the name of Popov and PHP co-author Rasmus Lerdorf. 

Both the changes were innocently captioned to reflect that they fixed typos in the code. Since all changes go through a mandatory post-commit code review, the true intentions of the malicious changes were soon unraveled.

The threat actors must have assumed that using the name of senior PHP developers wouldn’t subject the changes to a detailed examination, especially for something as trivial as a typo fix. Their scheme fell apart though when a PHP developer pinged Lerdorf to explain the intention of the code that was committed in his name. 

Popov added that while the developers aren’t sure what exactly allowed the threat actors to make the modifications, prima facie evidence points to a compromise of PHP’s git server, rather than a compromise of an individual git account. 

This is why, even while the developers are investigating the attack, they’ve moved PHP development to GitHub, which puts a great onus on security (opens in new tab). 

Popov rounds up by sharing that the developers are reviewing the repositories for any corruption beyond the two changes that have caught.

Via: BleepingComputer (opens in new tab)

Mayank Sharma
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

See more Computing news