“While investigation is still underway, we have decided that maintaining our own git infrastructure is an unnecessary security risk, and that we will discontinue the git.php.net server.”
Someone pushed two malicious commits to php-src under the names of Rasmus Lerdorf and Nikita Popov. The likely cause was the project’s own git server. PHP runs a huge share of the web. Its source of truth now lives on GitHub, because self-hosting turned out to be the bigger risk.