What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
On March 28, 2021, two malicious commits were pushed to PHP’s php-src repository using the names of maintainers Rasmus Lerdorf and Nikita Popov. The changes attempted to add a backdoor, but maintainers reverted them, and the available reporting says they were caught before the code was introduced publicly through an update. The incident exposed a risk in source-code access—not evidence that a backdoored PHP release reached users.
What happened when hackers tried to backdoor PHP?
The commits appeared in php-src, the repository used to develop the PHP programming language. The first malicious change was reverted; a second commit then reintroduced it. Both commits carried the names of Lerdorf and Popov, but names displayed on commits do not establish who actually authored them. The PHP maintainer notice documents the workflow changes that followed: “Changes to Git commit workflow”.
The attempted change was malicious code intended to provide a backdoor. PHP.Watch’s incident timeline describes the commits and the project’s response in its April 7, 2021 update.
Did the PHP backdoor make it into a release?
The available sources describe the commits being reverted and the attempted backdoor being caught before it was introduced publicly through an update. CyberScoop reported the incident as an effort stopped before public distribution: “Hackers try to bug PHP programming language in supply chain cautionary tale”.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
The reviewed reporting does not document a PHP release containing the backdoor or confirmed production infections. That is an evidence-limited conclusion: it distinguishes the malicious repository activity from a compromised release, but does not establish that no one ever encountered the affected development code.
How did the attackers push commits to the PHP repository?
The initial account: possible server compromise
In his March 29 notice, Popov said the evidence then pointed to a compromise of git.php.net, rather than an individual maintainer’s account. He also said the investigation was continuing. That was the initial assessment, not the final explanation.
Rank #2
The later account: password authentication, cause unconfirmed
In an April follow-up, maintainers said they no longer believed the Git server itself had been compromised. SecurityWeek’s report on the update says the attacker apparently pushed using password authentication over HTTPS. A leak of the master.php.net user database was raised as a possible explanation, not established as the cause; an old-system vulnerability was also discussed as a possibility. The account does not confirm how the credentials were obtained or who was responsible. See SecurityWeek’s April 8, 2021 report.
These accounts describe changing conclusions as the investigation developed. It would be inaccurate to compress them into a claim that either the Git server or a particular maintainer account was definitively hacked.
Why did PHP move its Git repository to GitHub?
On March 29, Popov announced that GitHub would become the canonical repository and that git.php.net would no longer be used as a write destination. The project tied write access to membership in the PHP GitHub organization, which required two-factor authentication (2FA). PHP.Watch’s April 7 timeline records that git.php.net had become read-only, GitHub was canonical, releases were paused for two weeks, and account-management remediation followed.
Popov explained the decision in the maintainer notice: “While investigation is still underway, we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server.” Moving the canonical repository changed where write access was managed; the notice does not establish that changing hosting alone eliminates supply-chain risk.
Rank #4
What does the incident show about software supply-chain risk?
A source repository is an important link in a software supply chain, but a malicious commit and a compromised product release are different events. In PHP’s case, the documented incident involved unauthorized malicious changes in the development repository; maintainers reverted them before public distribution, according to the available reporting.
Quick Recap
- Repository access matters: controls over who can write to a project’s source code are part of protecting future releases.
- Investigations can change the explanation: the initial concern about server compromise was later revised, while the precise route by which access was obtained remained unconfirmed.
- Impact claims need a release boundary: the presence of malicious code in development does not by itself show that users received it.
- Incident response includes workflow changes: PHP moved canonical write activity to GitHub, required 2FA for organization membership governing write access, and made its former Git server read-only.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
