3 ms·
Well somebody screwed up here. Maybe PHP core developpers should concentrate on the security of their own website , it's more than embarrassing. There is no rea
by camus2 13y ago
Well somebody screwed up here. Maybe PHP core developpers should concentrate on the security of their own website , it's more than embarrassing. There is no reason why php.net should use anything more than a static site generator.
- ds9 13y agoFrom the headers, php.net seems to be Apache/PHP on BSD. This might be an example of a widespread ongoing attack pattern which is a bit of a mystery. For the past year or more there have been compromises in this pattern - Linux/unix platform, Apache webserver; foreign Javascript or PHP gets inserted somehow; and/or in some cases the server binary is replaced. Sample article: http://arstechnica.com/security/2013/04/exclusive-ongoing-malware-attack-targeting-apache-hijacks-20000-sites/ http://arstechnica.com/security/2013/04/exclusive-ongoing-ma... - you can find more on this. The big question is how the original exploit happens. It may be a long-out-there 0-day, or some admin tool that the sites have in common, or credentials taken from compromised boxes of developers, or something else. Edited to update info.