# MA-714.022019: MyCERT Alert - PHP Pear Vulnerability

**Date:** 01 Feb 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-714.022019  
**Advisory ID:** MA-714.022019

---

**1.0 Introduction**
MyCERT received information from valid sources about a security breach that has been found on http://pear.php.net webserver and go-pear.phar tampered by the attacker. The issue has been announced at the respective blog and acted by taking the page down temporarily until further notice.
PHP Pear is an open source framework which allows back-end developer to easily include functions such as caching, authentication configuration, encryption, web services & etc easily on their projects and websites.
**2.0 Impact**
The malicious code content will cause web compromised in any website that had installed the PEAR package manager.
**3.0 Affected Product**
- All Linux/Unix/BSD systems that download PHP Software will have PEAR package manager (go.pear.phar) pre-installed by default for the past six months.
- Windows and MacOS will also affected if users manually installed the component.
**4.0 Recommendations**
As of now, a fresh version 1.10.10 of pearweb\_phars is now available on Github to clear up go-pear.phar that was found in pear.php.net server, the new repository now contains GPG signature files for each phar file. The developer recommends that those who have installed the go-pear.phar file from the official website in the past six months to consider them compromised and download the Github version immediately.
**5.0 References**
- <https://thehackernews.com/2019/01/php-pear-hacked.html?m=1>
- <https://github.com/pear/pearweb_phars/releases/tag/v1.10.10>
- <http://blog.pear.php.net/>