The old, established PHP code acts as a front door to the database, double-checking the requests, cleaning up the data, and generally providing all of the business logic.

Attackers were able to place malicious code in the PHP central code repository by impersonating key developers, forcing changes to the PHP Group's infrastructure.