As many probably noticed yesterday, the entire PHP.net domain (subdomains and all) were marked by the Google Safe Browsing service as potentially harmful. The issue has been discovered and resolved so things are back to normal, but the development group wanted to provide an update as to the current status.

We are continuing to work through the repercussions of the php.net malware issue described in a news post earlier today. As part of this, the php.net systems team have audited every server operated by php.net, and have found that two servers were compromised: the server which hosted the www.php.net, static.php.net and git.php.net domains, and was previously suspected based on the JavaScript malware, and the server hosting bugs.php.net. The method by which these servers were compromised is unknown at this time.

The post talks about some of the actions taken since the compromise and more details about what happened. It all revolved around a malicious Javascript file that was served to some visitors of the site. For more information as it becomes available, check back with the main PHP.net site or follow official_php on Twitter.