PHP.net flagged for malware by Google, researchers confirm it was no false positive
On Thursday, PHP.net was flagged by Google's Safe Browsing for malware. The warning, sparked debate among the development and security communities, as the initial reaction claimed Google triggered a false positive. However, additional research makes that claim seem unlikely.
By mid-morning on Thursday, Google's Safe Browsing initiative was flagging PHP.net, warning visitors that the site was malicious. The root cause appears to be a JavaScript file that had undergone several modifications over the last 24-hours.
The file is clean now, but the version flagged by Google was embedding iFrames and treating visitors to malware hosted on four different sites. According to Google's report, there were only four pages on PHP.net serving the malicious JavaScript, out of a scan of more than 2,000. The low results, and the fact that only some visitors were seeing the warnings, led many to believe that Google had falsely flagged PHP.net.
