Visitors to PHP.net were served JavaScript malware last week. The site admins have removed the actual threats, but the method by which the site was breached is still not known