Yesterday (2021-03-28) two malicious commits were pushed to the php-src
repo  from the names of Rasmus Lerdorf and myself. We don’t yet know how
exactly this happened, but everything points towards a compromise of the
git.php.net server (rather than a compromise of an individual git account).