It's a pity you don't disclose which malware specifically the sites were distributing. As a user who may have been affected prior to google flagging it, it's frustrating to have no information on what to look for.

I think that you should direct your frustration towards the php.net admins and not Google.

It's linked further down the page.

You link seems to indicate that the site isn't suspicious and hasn't served malware in the last 90 days, what changed?

When I go to that page I see: "Of the 1838 pages we tested on the site over the past 90 days, 4 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-10-24, and the last time suspicious content was found on this site was on 2013-10-23."