The PHP project has announced
that it is moving its PHP repository to GitHub after its own server was
compromised. “Yesterday (2021-03-28) two malicious commits were
pushed to the php-src repo from the names of Rasmus Lerdorf and myself. We
don’t yet know how exactly this happened, but everything points towards a
compromise of the git.php.net server (rather than a compromise of an
individual git account).“

Source: LWN.net – PHP Git repository server compromised