Poisoned Pipeline / Incidents / AS4
php.net git server Zerodium backdoor
Packagist / ComposerGit / GitHub
On 28 March 2021 two malicious commits landed on git.php.net impersonating
PHP developers. The change would execute attacker-supplied code if the
HTTP User-Agent started with "zerodium". The official php.net news post
said the malicious commits were caught before they reached end-user
releases. PHP paused releases, enabled MFA, and later moved canonical
development to GitHub. The inherited text wrongly dated this to 2023.
Mapped techniques
- T0180 Compromise services / servers
- T0195 Spoofed Commits
- T0137 Weak authentication methods
- T0111 Malicious code contribution to an open-source repository
- T0191 Malicious code in artifacts
- T0172 Runtime backdoor
supply-chain git.php.net
The self-hosted PHP git server was the point of injection.
Commits impersonated two PHP developers.
Post-incident action was to require MFA; git.php.net was retired.
Backdoor committed into php-src.
Intended to ship in official PHP tarballs; caught before release.
post-supply-chain PHP users (if it had shipped)
User-Agent zerodium would have run attacker commands on every PHP server.