PHP's Git Server Compromised, Now Switching To GitHub

The PHP programming language's self-hosted Git server was compromised on Sunday and two malicious commits introduced.

The PHP core team is still investigating how the official PHP Git server was compromised but already they have decided to immediately abandon their self-hosted infrastructure and will instead use GitHub.

The malicious commits introduced a new vector for arbitrary code execution for specially crafted code within the HTTP headers. This would have obviously exposed many PHP servers to remote code execution if these commits had gone unnoticed and reached stable versions / production environments.

PHP already provided a read-only copy of their Git repository via GitHub while moving forward that will now become the official source.

Switching to GitHub means they will also be accepting merge requests via GitHub too

More details on the PHP mailing list.