PHP 曝出严重安全漏洞，大量网站主动下线
What’s going on with the web? The PHP issue and sites going offline
AI 模型与一名网络安全研究员在 8 月中旬同时发现 PHP 中的重大安全漏洞，两个漏洞组合利用可让攻击者直接访问网站背后的文件系统或数据库。漏洞披露被暂缓至本周，但并非所有网站都已安装补丁，AWS 称这些漏洞正被“广泛利用”，NSA 建议未修补的网站先下线。因此大量商业和政府网站已下线，9to5Mac 及其姊妹站点表示已受保护。
正文
当前显示原文，中文全文译文尚未就绪。
A significant number of websites have gone offline, and that’s not due to a service outage, but rather a deliberate decision by the site’s owners.
The reason is because extremely dangerous security vulnerabilities have been found in a protocol used by most websites – PHP. This issue is unrelated to the separate vulnerability discovered in web certificates …
What is PHP?
PHP is one of the weirder acronyms around. While it originally stood for Personal Home Page, it’s now more usually defined as the recursive “PHP: Hypertext Preprocessor.”
PHP is an open-source, general-purpose scripting language, very well suited to web development and able to be embedded into HTML. It’s used by around 70% of all websites.
What happened?
AI models and a cybersecurity researcher simultaneously discovered a major security flaw in PHP in mid-August. A combination of two vulnerabilities allowed an exploit which could give an attacker direct access to the underlying file system or database behind a website. That could expose a vast amount of personal data.
To allow time for the problem to be patched by the PHP Foundation, disclosure of the vulnerabilities was embargoed until this week (though it leaked two days ahead of the embargo). However, not every website has been able to apply the patch as yet, and Amazon Web Services said that the vulnerabilities are being “broadly exploited” across the internet.
The problem is so serious that the NSA has advised that unpatched sites be taken offline until the problem is fixed.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…— NSA Cyber (@NSACyber) October 21, 2026
For that reason, a great many commercial and government websites have been taken offline until PHP can be updated on their servers.
I’m happy to be able to confirm that 9to5Mac and its sister sites are already protected.
iPhone Duo cases
Beats Woven USB-C cables