php.net site got malware??

Discussion:

Haluk Karamete

2013-10-24 12:45:55 UTC

This morning, chrome warned me with this message:

The Website Ahead Contains Malware!
Google Chrome has blocked access to php.net for now.
I needed to visit the site for a function look up. But I had to stop.
Just sharing for what it's worth...

What do we do? proceed or wait?

Andrew Nacin

2013-10-24 12:54:54 UTC

Permalink

See https://twitter.com/rasmus/status/393258147025932288 and generally
@rasmus's last few dozen tweets. It appears to be either nothing, or a
problem with a mirror.

Post by Haluk Karamete
The Website Ahead Contains Malware!
Google Chrome has blocked access to php.net for now.
I needed to visit the site for a function look up. But I had to stop.
Just sharing for what it's worth...
What do we do? proceed or wait?
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers

Peter van der Does

2013-10-24 13:08:46 UTC

Permalink

On Thu, 24 Oct 2013 08:54:54 -0400

Post by Andrew Nacin
See https://twitter.com/rasmus/status/393258147025932288 and generally
@rasmus's last few dozen tweets. It appears to be either nothing, or a
problem with a mirror.

Not so much false, just no longer an issue, but their userprefs.js file
seems to be compromised at one point:

https://news.ycombinator.com/item?id=6604251

--
Peter van der Does

GPG key: CB317D6E

Site: http://avirtualhome.com
GitHub: https://github.com/petervanderdoes
Twitter: @petervanderdoes

Nikola Nikolov

2013-10-24 12:56:34 UTC

Permalink

I got a message on the WordFence list stating that it got flagged as
malware(I was experiencing some un-availability of the site at some point
in the last couple of days). Here's their guess on the issue:

The report Google is issuing for php.net is available
here<http://www.google.com/safebrowsing/diagnostic?site=php.net> .
We haven't been able to verify if php.net has been hacked, but Google
states they crawled the site yesterday and found 4 trojans hosted on 4
domains. If you're a WordPress developer and need to visit php.net to
access PHP documentation, please take care until this is resolved. It is
quite likely a false positive or due to simple backlinks to malicious
domains appearing on php.net, but the worst case scenario is that the site
has been hacked and malware is hosted on the site itself.

So - I'd suggest to wait for now. It seems that they've already filed a
Request for Review according to this thread -
http://productforums.google.com/forum/#!topic/webmasters/puLmvjtK0m8%5B1-25-false%5D