❗A pair of malicious commits were made in the PHP source code repository over the weekend. These commits were immediately noticed and reverted, and never reached end users.
— php.net (@official_php) March 31, 2021
Because we're still investigating the root cause, we are putting releases on hold for at least two weeks.