#PHP CODE HACKED TO BACKDOORS TO SOFTWARE#

The changes were rather obviously malicious and reverted right away,” Popov told BleepingComputer.Īdditionally, the malicious commit was made in the name of PHP creator, Rasmus Lerdorf.īut, that is hardly surprising as with source code version control systems like Git, it is possible to sign-off a commit as coming from anybody else locally and then upload the spoofed commit to the remote Git server, where it gives off the impression as if it had indeed been signed-off by the person named on it.

“The first commit was found a couple hours after it was made, as part of routine post-commit code review. In an email interview, PHP maintainer Nikita Popov told us:

“This line executes PHP code from within the useragent HTTP header, if the string starts with ‘zerodium’,” responded PHP developer Jake Birchall to Michael Voříšek, who had first pointed out the anomaly. However, taking a look at the added line 370 where zend_eval_string function is called, the code actually plants a backdoor for obtaining easy Remote Code Execution (RCE) on a website running this hijacked version of PHP. In the malicious commits seen by BleepingComputer, the attackers published a mysterious change upstream, “fix typo” under the pretense this was a minor typographical correction.Ī malicious commit that attackers signed off on as Rasmus Lerdorf (illicitly) plants a remote code execution backdoor The incident is alarming considering PHP remains the server-side programming language to power over 79% of the websites on the Internet. In an attempt to compromise the PHP code base, two malicious commits were pushed to the official PHP Git repository yesterday. The threat actors had signed off on these commits as if these were made by known PHP developers and maintainers, Rasmus Lerdorf and Nikita Popov.

Yesterday, two malicious commits were pushed to the php-src Git repository maintained by the PHP team on their server.

#PHP CODE HACKED TO BACKDOORS TO SOFTWARE#

In the latest software supply chain attack, the official PHP Git repository was hacked and the code base tampered with.

Php code hacked to backdoors to