Pear.php.net shuts down after maintainers discover serious supply-chain attack

Officials with the widely used PHP Extension and Application Repository have temporarily shut down most of their website and are urging users to inspect their systems after discovering hackers replaced the main package manager with a malicious one. phar [package manager] in the past six months, you should get a new copy of the same release version from GitHub (pear/pearweb_phars) and compare file hashes,” officials wrote on the site’s blog. What’s more, results from VirusTotal, the Google-owned malware scanning service, suggest that the malicious PEAR download installed a backdoor, possibly in the form of a Web shell, on infected servers. PEAR officials didn’t respond to questions about how and when the breach of their Web server occurred or what the malicious download did.

Source: arstechnica.com