❗A pair of malicious commits were made in the PHP source code repository over the weekend. These commits were immediately noticed and reverted, and never reached end users.

Because we're still investigating the root cause, we are putting releases on hold for at least two weeks.

— php.net (@official_php) March 31, 2021