Two malicious changes were made to the development branch of the upcoming PHP v8.1 (opens in new tab) in an attempt to add a backdoor to any website that runs this tainted version of the popular web development (opens in new tab) language.
While the objectionable code was caught and removed within a few hours, given the fact that PHP powers almost 80% of all websites (opens in new tab) on the Internet, the PHP developers have made some key infrastructural changes while they investigate the incident.
“While investigation is still underway, we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server,” shared PHP maintainer (opens in new tab) Nikita Popov.
We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.
>> Click here to start the survey in a new window (opens in new tab)<<
- These are the best laptops for programming (opens in new tab)
- And here are the best developer distros (opens in new tab)
Ramping up security
The threat actors made the two code changes in the name of Popov and PHP co-author Rasmus Lerdorf.
Both the changes were innocently captioned to reflect that they fixed typos in the code. Since all changes go through a mandatory post-commit code review, the true intentions of the malicious changes were soon unraveled.
The threat actors must have assumed that using the name of senior PHP developers wouldn’t subject the changes to a detailed examination, especially for something as trivial as a typo fix. Their scheme fell apart though when a PHP developer pinged Lerdorf to explain the intention of the code that was committed in his name.
Popov added that while the developers aren’t sure what exactly allowed the threat actors to make the modifications, prima facie evidence points to a compromise of PHP’s git server, rather than a compromise of an individual git account.
This is why, even while the developers are investigating the attack, they’ve moved PHP development to GitHub, which puts a great onus on security (opens in new tab).
Popov rounds up by sharing that the developers are reviewing the repositories for any corruption beyond the two changes that have caught.
- Here are some of the best free website builders (opens in new tab)
Via: BleepingComputer (opens in new tab)