{"id":99606,"date":"2021-03-29T22:22:34","date_gmt":"2021-03-29T20:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya"},"modified":"2021-03-29T22:22:34","modified_gmt":"2021-03-29T20:22:34","slug":"v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","title":{"rendered":"Malicious changes have been identified in the Git repository of the PHP project","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The PHP project developers have issued a warning about the compromise of the project's Git repository and the discovery of two malicious commits that were added on March 28 to the php-src repository under the names of Rasmus Lerdorf, the founder of PHP, and Nikita Popov, one of the key PHP developers. <\/p>\n

As there is no confidence in the reliability of the server that hosted the Git repository, the developers decided that maintaining their own Git infrastructure poses additional security risks and have moved the reference repository to the GitHub platform, which is recommended to be used as the primary one. All changes should now be sent to GitHub, not git.php.net, and even development can now utilize the GitHub web interface. <\/p>\n

In the first malicious commit disguised as a typo correction in the file ext\/zlib\/zlib.c, a change was made that executes PHP code passed in the User Agent HTTP header if the content starts with the word \"zerodium.\" After the developers noticed the malicious change and reverted it, a second commit appeared in the repository that undid the PHP developers' actions and reinstated the malicious change. <\/p>\n

The added code contains the line \"REMOVETHIS: sold to zerodium, mid 2017,\" which may suggest that since 2017, there has been another, better camouflaged malicious change in the code, or an unpatched vulnerability sold to Zerodium, a company that acquires 0-day vulnerabilities (Zerodium has responded that it did not purchase information about vulnerabilities in PHP). <\/p>\n

Currently, there is no detailed information regarding the incident; it is only assumed that the changes were added as a result of the hacking of git.php.net rather than the compromise of individual developers' accounts. An analysis of the repository for other malicious changes beyond the identified issues has begun. Everyone is invited to participate in the review, and any suspicious changes should be reported to security@php.net. server<\/a> git.php.net, rather than compromising individual developer accounts. An analysis of the repository has begun to look for other malicious changes beyond the identified issues. Everyone is invited to review, and if any suspicious changes are detected, please report them to security@php.net. <\/p>\n

Regarding the transition to GitHub, contributors need to become members of the PHP organization to gain write access to the new repository. Those who are not among the PHP developers on GitHub should contact Nikita Popov at email nikic@php.net. A requirement for adding members is enabling two-factor authentication. Once the appropriate permissions are granted, changing the repository is as simple as running the command \"git remote set-url origin git@github.com:php\/php-src.git.\" Additionally, consideration is being given to a mandatory digital signature verification of commits by developers. It is also proposed to prohibit direct additions of changes that have not undergone prior review.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b \u041f\u043e\u043f\u043e\u0432\u0430, \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP. \u0422\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u0442 \u0443\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u0448\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 Git-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0440\u0438\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99606","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Malicious changes detected in the Git repository of the PHP project | ProHoster","description":"PHP project developers have warned about the compromise of the project's Git repository and the discovery of two malicious commits added on March 28 in the php-src repository on behalf of Rasmus Lerdorf, the founder of PHP, and Nikita.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 PHP \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0432\u0443\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 28 \u043c\u0430\u0440\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 php-src \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0420\u0430\u0441\u043c\u0443\u0441\u0430 \u041b\u0435\u0440\u0434\u043e\u0440\u0444\u0430, \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044f PHP, \u0438 \u041d\u0438\u043a\u0438\u0442\u044b.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-git-repozitorii-proekta-php-vyyavleny-vredonosnye-izmeneniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-29T20:22:34+00:00","article:modified_time":"2021-03-29T20:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99606","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-29 20:30:58","updated":"2026-02-22 15:29:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/99606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=99606"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/99606\/revisions"}],"predecessor-version":[{"id":162210,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/99606\/revisions\/162210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=99606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=99606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=99606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}