Here are some open-source exchanges[1][2][3][4] (only the last one uses PHP). There is no guarantee that these projects don't have any bugs/backdoors. Unless you're a Senior developer and have a lot of experience, you probably shouldn't use them for anything other than educational purposes.