NSA 警告 PHP 核心漏洞 PHP2Shell，称由 GPT-5.6 Sol 辅助发现
National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language
NSA 要求组织修复两个被命名为 PHP2Shell 的 PHP 核心漏洞，或下线未打补丁的服务器；据称加州研究人员借助 OpenAI 的 GPT-5.6 Sol 发现了这些漏洞。两个漏洞都位于 PHP 核心，任何处理 Web 请求的安装都受影响；在 Apache 的 mod_php 上，已演示的攻击会在应用代码执行前触发内存破坏，登录和应用层检查无法拦截。Cloudflare 在 PHP 于 10 月 21 日发布 8.5.12、8.4.27、8.3.36 和 8.2.35 修复版本前已观察到攻击，VirusTotal 统计约 510 万个 IP 运行 PHP，其中约 75.8 万个运行已停止维护、没有补丁版本的分支。
推荐理由
精选AI 评分 85
原文交代了 PHP 两个核心漏洞的触发机制、修复版本和未打补丁的存量规模，可据此判断暴露面。
主题
查看原帖研究人员使用 GPT-5.6 Sol 发现 PHP 存在一个极其严重的漏洞，而约 70% 的网站都在运行 PHP；在运维人员争相打补丁之际，该漏洞导致多家大型网站下线。 发现该漏洞的 AI 安全公司 Calif 在一份声明中表示，如果不尽快修补，这些漏洞可能使全球 70% 的网站面临风险，并称其为“AI 迄今发现的最严重漏洞，甚至可能是整个软件史上最严重的漏洞”。 > PHP 紧急发布了修复程序，因为这些漏洞可能让无账号的攻击者接管 Web 服务器。 > 两个漏洞在 CVSS 严重性评分中均为 9.2 分，影响低至 5.4 的 PHP 版本。 > 当请求在错误时机触及 PHP 的内存上限时，PHP 会释放内存但保留指向该内存的指针，该工作进程上后续的请求便可劫持这块内存。 > 审计人员早在 2024 年就发现了这一弱点，但修复工作停滞了数月，部分原因是此前无人展示过实际可行的攻击。 > 现由谷歌所有的云安全公司 Wiz 表示，这些模型让一名研究人员在一周内完成了过去顶尖团队需要数月才能完成的工作。 > CVE 编号的泄露迫使 PHP 提前一天发布，Cloudflare 目前报告称已出现早期攻击尝试。
查看原文
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch. Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.” > PHP rushed out fixes as it could let attackers without accounts take over web servers. > Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4. > When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack. > Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack. > Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months. > A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.
正文
National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language
Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol
In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online.
The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline.
Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top.
When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust.
On Apache’s mod_php, a demonstrated exploit triggers the corruption before any application code runs, so logins and app-level checks cannot block it.
Cloudflare saw attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21.
VirusTotal counts about 5.1M IP addresses running PHP, and about 758K that show a version run end-of-life branches with no patched release. That long tail will set how long PHP2Shell stays exploitable, since each owner must upgrade, find a backport or take the server offline.