The Web site for the popular PHP server-side scripting language had two of its servers compromised by malware, red-faced administrators said on Thursday.
"[T]he php.net systems team have audited every server operated by php.net and have found that two servers were compromised," the company said in a blog post. PHP had initially claimed that it was flagged by the settings of Google's Chrome and Mozilla Firefox as a false positive, saying Google was slow to provide answers as to why visiting the site produced the following warning:
"This web page at php.net has been reported as an attack page and has been blocked based on your security preferences."
Google's Safe Browsing service posted an explanation, saying "Of the 2428 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent." Google said the malicious software included four Trojan horse-type attacks, was hosted on four domains, and three domains appeared to be functioning as intermediaries distributing malware to visitors of php.net.
As of Friday afternoon, Google said the site "is not currently listed as suspicious."
PHP said the two servers compromised hosted the php.net, static.php.net and git.php.net domains. "All affected services have been migrated off those services," the company said. "We have verified that our Git repository was not compromised and it remains in read only mode as services are brought back up."
Chester Wisniewski, a Toronto-based cybersecurity expert for Sophos International, noted that while PHP.net does not have a long history of harboring malicious content, the PHP programming language "has had a very troubled past with regards to security vulnerabilities and being difficult to code in safely." He noted that the language is used for such popular blogging platforms as WordPress and utilities like PHPMyAdmin.
"It appears whoever compromised the server was simply using its popularity to distribute malware, rather than specifically targeting the PHP source code itself," Wisniewski said.
Loose Controls and Monitors?
He added that the PHP team's uncertainty about how the bad code was implanted was worrisome. "You would expect a website in the Alex top 250 to have appropriate monitors and controls in place to trace back what happened. Time will tell if that is the case."
PHP said in its news post, "We will provide a full postmortem in due course, most likely next week," adding that updates would come from the company's official Twitter feed, @official_php.