You are describing a few different problems.
Storage of credentials and other secrets
I don't want to store this 'master' key in the source code (PHP), on disk, or anywhere else in plain text.
You are correct that hardcoding secrets is a bad idea, you may want to try using something like hashicorpo-vault (This particular article may be related to your workflow as well) or a Key management service like Amazon KMS.
Multi-user Encrypted Access
There are a few different strategies to this type of setup. You can encrypt the data with a shared key and then encrypt that key for each user using the user's public key. You would then need to update the per file key and re-encrypt with each user's public key again if there was any change in the access group's membership.
Deriving a key based on the password can be complicated because you need to ensure you properly update all of the keys and redo all the encryption if the user's password changes.
You may want to look at MIT's Mylar project, as it tries to accomplish something similar to the storage and access model you described.
My initial concern is that if there is a data breach of source code and data, then an attacker would see that the same key was encrypted many times (once for each user). Could this then reduce the security of the 'master' key?
If you are ever decrypting server side and the attacker has access they can grab the decrypted copy of the data.
If you are creating user's private keys using the password as the seed then you have some risks especially if the passwords can be identified by stealing them or reversing the hashes.
Could this then reduce the security of the 'master' key? Either by patterns in the encrypted data or by testing that a decryption attempt on one record matches that of another?
I believe you are asking if encrypting the same value with multiple different per-user keys would make it easier to get back to the original plaintext value (?).
If you happen to know the plaintext value you may be able to figure out the other encryption values. This is known as a "known plaintext" attack. However, this does not mean it works if you just happen to know two different encryption outcomes and know the input was the same, but you don't know the actual input.
Your question may also be that given encryption function
f(key, masterkey) and then running it once with
key1 and then with
key2 would comparing the two outcomes allow you to figure out
masterkey or would knowing the output of
f(key1, masterkey) allow you to figure out
It may be possible, but would depend on the specific algorithms, if there is padding, etc. If there is significant entropy in the algorithms then slight changes in inputs should give very different outputs that do not show patterns. You may also want to read up on "weak keys" and chosen-plaintext attacks.