Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:69862 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 17169 invoked from network); 25 Oct 2013 07:41:16 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 25 Oct 2013 07:41:16 -0000 Authentication-Results: pb1.pair.com smtp.mail=rowan.collins@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=rowan.collins@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.172 as permitted sender) X-PHP-List-Original-Sender: rowan.collins@gmail.com X-Host-Fingerprint: 74.125.82.172 mail-we0-f172.google.com Received: from [74.125.82.172] ([74.125.82.172:55496] helo=mail-we0-f172.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 7E/D6-10840-B902A625 for ; Fri, 25 Oct 2013 03:41:16 -0400 Received: by mail-we0-f172.google.com with SMTP id q58so3446116wes.31 for ; Fri, 25 Oct 2013 00:41:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=jXs/7twD3xa/B+NQ5ArxhDnRRfdy/135BkxPlpG/a+Q=; b=YOSFZlO02bOb/X2kgClM0vqh6YCq2OqDyTtcLQFTknykYmRepInA+U3BYsD9d21gHD MATJvTW4qoeqCtHbwCVGyjQ54SYvmkqUj2/OftJ7mbdxus1BiqmRBYBfCLqw9FLVTbW3 WBQPMmbnkclbUL9ZbNwktBUZgWBRsQ2HJINGswaEmzIftzTlH2ug8fSlp1tURNqDol3S o0iuWIlwsO5OKenDerjcaHT2n76uYQmRW2SoWWAdwApB/DGrdCMtlgVTs3GE3qcJkabS 57/5JNc6rxPRZUg0lJSlbsPbiKFlsR5j4auGEYGxtlguSDXwh3Nv+jw5Lwtd8ctoBr8O 4eXw== X-Received: by 10.180.73.109 with SMTP id k13mr1188079wiv.35.1382686873108; Fri, 25 Oct 2013 00:41:13 -0700 (PDT) Received: from [192.168.0.121] ([62.189.198.114]) by mx.google.com with ESMTPSA id y20sm3167192wib.0.2013.10.25.00.41.12 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 25 Oct 2013 00:41:12 -0700 (PDT) Message-ID: <526A2098.2060907@gmail.com> Date: Fri, 25 Oct 2013 08:41:12 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1 MIME-Version: 1.0 To: internals@lists.php.net References: <5269018C.6020200@cubiclesoft.com> <5269071C.1040403@lsces.co.uk> <1382622938.8840.300.camel@guybrush> In-Reply-To: <1382622938.8840.300.camel@guybrush> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Subject: Re: [PHP-DEV] php.net - The Website Ahead Contains Malware From: rowan.collins@gmail.com (Rowan Collins) Johannes Schlüter wrote (on 24/10/2013): > Aside from that: We are investigating the cause for these issues, > public announcements will follow later. No need for speculation here. > :-) johannes In case anyone missed them, there are now two updates on http://www.php.net/archive/2013.php with investigations on going, and a Twitter account has been brought into service https://twitter.com/official_php > tl;dr: Two servers were compromised; services have been migrated to > new hardware; Git and release tarballs are OK. -- Rowan Collins [IMSoP]