Press Release
PHP source code was given backdoors thanks to a compromise of the Git server.
The official PHP Git repository was breached in the most recent software supply chain attack, and the code base was modified.
Yesterday, two malicious commits were uploaded to the PHP team’s git.php.net server, which hosts the php-src Git repository.
Threat actors had verified these commits as if Rasmus Lerdorf and Nikita Popov, two well-known PHP developers and maintainers, had made them.
PHP Git server has an RCE backdoor installed.
Yesterday, two malicious contributions were uploaded to the official PHP Git repository in an effort to corrupt the PHP code base.
The event is concerning because 79% of websites on the Internet still use PHP as their server-side programming language.
The attackers released a mystery update upstream called “repair typo” in the malicious commits [1, 2] that BleepingComputer saw under the guise of a little typographical patch.
Looking closer at the newly added line 370, where the zend eval string function is used, reveals that the code in fact creates a backdoor for quickly achieving Remote Code Execution (RCE) on a website using this hacked version of PHP.
Developer Jake Birchall for PHP responded to Michael Voek, who had discovered the error originally, with the explanation, “This line executes PHP code from within the useragent HTTP header, if the string starts with ‘zerodium’.”
Nikita Popov, a PHP maintainer, explained the following to us via email:
“During a regular post-commit code review a few hours after the first commit, it was discovered. The modifications were immediately undone because they were blatantly malicious “According to Popov, BleepingComputer.
The malicious commit was also done under Rasmus Lerdorf’s identity, the person who created PHP.
But that should come as no surprise because with source code version control systems like Git, it is possible to sign off a change locally under a different identity [1, 2] and then upload the spoof commit to the remote Git server, where it appears to have been signed off by the person listed on it.
According to PHP maintainers, this malicious activity originated from the compromised git.php.net server rather than from the compromise of an individual’s Git account, despite the fact that a thorough investigation of the incident is still ongoing.
The official PHP codebase has been moved to GitHub.
Following this event, the PHP maintainers have chosen to move the official PHP source code repository to GitHub as a precaution.
We’ve made the decision to stop running the git.php.net server even though our investigation is still ongoing since we believe that keeping our own git infrastructure is an unnecessary security risk.
Popov stated that the GitHub repositories, which were previously merely mirrors, “would become canonical.”
After this modification, Popov demands that any future code updates be uploaded directly to GitHub rather than the git.php.net site.
Anyone who wants to contribute to the PHP project must now join the PHP organisation on GitHub.
The same security alert includes advice for doing that.
You would need to have two-factor authentication (2FA) set on your GitHub account in order to join the organisation.
Beyond the two commits that were mentioned, “We’re investigating the repositories for any corruption,” says Popov.
In order to learn the full scope of this attack and whether any code was transmitted downstream before the fraudulent commits were discovered, BleepingComputer contacted Popov and the PHP security team.
Although it might have been cloned or forked in the interim, no tags or release artefacts reflect the changes.
Popov added to BleepingComputer, “The changes were in the development branch for PHP 8.1, which is scheduled for release at the end of the year.
The PHP team has confirmed to BleepingComputer that they want to decommission their git server ultimately and switch to GitHub permanently in the coming days.
Press Release
Russian processor manufacturers are prohibited from using ARM because of UK sanctions.
On Wednesday, the UK government expanded its list of sanctioned Russian organisations by 63. The two most significant chip manufacturers in Russia, Baikal Electronics and MCST (Moscow Center of SPARC Technologies), are among them.
Since the licensee, Arm Ltd., is situated in Cambridge, England, and must abide by the penalties, the two sanctioned firms will now be denied access to the ARM architecture.
contacting inactive entities
The UK government provided the following justification for the restrictive measures put in place against Baikal and MCST:
The clause’s goal is to persuade Russia to stop acting in a way that threatens Ukraine’s territorial integrity, sovereignty, or independence or that destabilises Ukraine.
The two companies are important to Russia’s ambitions to achieve technical independence since they are anticipated to step up and fill the gaps left by the absence of processors built by Western chip manufacturers like Intel and AMD.
The two currently available most cutting-edge processors are:
Eight ARM Cortex A57 cores running at 1.5 GHz and an ARM Mali-T628 GPU running at 750 MHz make up the 35 Watt Baikal BE-M1000 (28nm) processor.
MCST Elbrus-16S (28nm), a 16-core processor clocked at 2.0 GHz, is capable of 1.5 TFLOP calculations, which is a tenth of what an Xbox Series X can do. Baikal BE-S1000 (16nm), a 120 Watt processor featuring 48 ARM cores clocked at 2.0 GHz, MCST Elbrus-8C (28nm), a 70 Watt processor featuring eight cores clocked at 1.3 GHz,
Russian businesses and organisations that evaluated these chips in demanding applications claim that they fall short of industry standards and are even unacceptably priced.
Although the performance of these processors and the far poorer mid-tier and low-tier chips with the Baikal and MCST stickers is not very spectacular, they could keep some crucial components of the Russian IT sector operating amid shortages.
In reality, MCST recently bragged that it was “rushing to the rescue” of vital Russian enterprises and organisations, successfully filling the void left in the domestic market.
sanctions’ effects
Given that Russia has previously demonstrated its willingness to relax licencing requirements in order to mitigate the consequences of Western-imposed limitations, it is simple to discount the application and impact of the UK’s sanctions.
It is crucial to keep in mind that the Baikal and MCST processors are produced in foreign foundries, such as those owned by Samsung and TSMC, and that neither of them would violate Arm’s licencing policies or international law to serve Russian objectives.
The only option is to bring the production home and break the law as Baikal, which has a legitimate licence to produce at 16nm, only has a design licence for its next products.
The fact that chip fabrication in Russia can only now be done at the 90nm node level presents yet another significant issue. That was the same technology NVIDIA employed in 2006 for its GeForce 7000-series GPUs.
To combat this in April 2022, the Russian government has already approved an investment of 3.19 trillion rubles (38.2 billion USD), although increasing domestic production will take many years. In the best-case scenarios, 28nm circuits will be able to be produced by Russian foundries by 2030.
Press Release
PE firm Insight Allies spends $290M for a bulk risk in CivicPlus, which provides software and also various other innovation to greater than 4,000 municipal governments (AJ Dome/Manhattan Mercury).
PE firm Insight Partners invests $290M for a majority stake in CivicPlus, which provides software and other technology to more than 4,000 municipal governments (AJ Dome/Manhattan Mercury)
AJ Dome / Manhattan Mercury:
PE firm Insight Partners invests $290M for a majority stake in CivicPlus, which provides software and other technology to more than 4,000 municipal governments — A Manhattan software business owner says a multimillion-dollar investment into the company will not change the company’s makeup.
Press Release
EXAMINING THE LINKS BETWEEN THE RATIONALIST COMMUNITY, WITH SLATE STAR CODEX BLOG AS ITS EPICENTER, AND INFLUENTIAL LEADERS IN TECH, INCLUDING OPENAI’S FOUNDERS (CADE METZ/NEW YORK TIMES)
Examining the links between the Rationalist community, with Slate Star Codex blog as its epicenter, and influential leaders in tech, including OpenAI’s founders — Slate Star Codex was a window into the psyche of many tech leaders building our collective future. Then it disappeared.
-
Social Media10 months agoWho is Rouba Saadeh?
-
Apps10 months agoWhy is Everyone Talking About Hindi Keyboards?
-
Social Media10 months agoMati Marroni Instagram Wiki (Model’s Age, Net Worth, Body Measurements, Marriage)
-
Entertainment10 months ago12 Online Streaming Sites that Serve as Best Alternatives to CouchTuner
-
Apps10 months agoThings you need to know about Marathi keyboard today
-
Apps10 months agoStuck with Your default Bangla keyboard? Isn’t it time for a change?
-
Entertainment10 months agoMovierulz Website: Movierulzz 2021 Latest Movies on Movierulz.com
-
Social Media10 months agoBrooke Daniells: Everything About Catherine Bell’s Partner