An attacker added a backdoor to a code repository for the widely used, open-source PHP server-side scripting language. The code included a reference to zero-day vulnerability broker Zerodium. The last stable release of PHP to be issued, version 8.0.3, was released on March 4, well before the malicious commit was made on Sunday. It’s unclear if the backdoored code was downloaded and added to any public-facing websites by anyone handling beta code. At least 79% of all websites use PHP, according to Web Technology Surveys.”]
Source: https://www.govinfosecurity.com/attacker-updates-php-source-code-to-include-backdoor-a-16286