<story><title>PHP&apos;s Git server compromised, moving to GitHub</title><url>https://news-web.php.net/php.internals/113838</url></story><parent_chain></parent_chain><comment><author>Sebb767</author><text>Zerodium[0], the magic string searched for in the fake user agent, is a zero-day acquisition platform, in case anyone else is wondering. The third parameter to `zend_eval_string` in the commit [1] is the &amp;quot;filename&amp;quot; [2] of the executed code, which is probably used for stack traces. Which is quite a strange choice, because seeing that in the logs would probably ring alarm bells immediately. Overall, this commit seems strange in its structure IMO - not in a &amp;quot;good&amp;quot; covert way, but in a &amp;quot;why does it not try to hide better&amp;quot; way.&lt;p&gt;EDIT: According to zerodiums charts, this would have been a payout of up to 250k$. However, I&amp;#x27;m not quite sure what the attackers plan on cashing out on that would have been, given that the exploit would have quite obviously referenced zerodium and therefore would make the submitter the primary suspect of being the author. Maybe some APT used this &amp;quot;simple&amp;quot; format to disguise the actual power? But then again, it would be in their interest for the exploit to actually go through.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.zerodium.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.zerodium.com&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;php&amp;#x2F;php-src&amp;#x2F;commit&amp;#x2F;c730aa26bd52829a49f2ad284b181b7e82a68d7d#diff-a35f2ee9e1d2d3983a3270ee10ec70bf86349c53febdeabdf104f88cb2167961R370&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;php&amp;#x2F;php-src&amp;#x2F;commit&amp;#x2F;c730aa26bd52829a49f2ad...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugs.php.net&amp;#x2F;bug.php?id=78224&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugs.php.net&amp;#x2F;bug.php?id=78224&lt;/a&gt; (only mention I found with a documented use of the parameter)&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;zerodium.com&amp;#x2F;program.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;zerodium.com&amp;#x2F;program.html&lt;/a&gt;</text></comment>
<story><title>PHP&apos;s Git server compromised, moving to GitHub</title><url>https://news-web.php.net/php.internals/113838</url></story><parent_chain></parent_chain><comment><author>lovedswain</author><text>Trying to sneak that diff in was a hugely wasted opportunity, it sticks out like a sore thumb. If they were going to commit anything, it should have looked like a legitimate change.  Another option might have been to wait until just before a release and fiddle with the tags or the newly opened QA branch (if any).&lt;p&gt;Check out &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;freedom-to-tinker.com&amp;#x2F;2013&amp;#x2F;10&amp;#x2F;09&amp;#x2F;the-linux-backdoor-attempt-of-2003&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;freedom-to-tinker.com&amp;#x2F;2013&amp;#x2F;10&amp;#x2F;09&amp;#x2F;the-linux-backdoor-...&lt;/a&gt; for another attempt, that one at least requires careful review to notice the problem</text></comment>