AI 安全公司 Calif 用 GPT-5.6 Sol 发现 PHP 严重漏洞，波及约 70% 网站
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
AI 安全公司 Calif 使用 GPT-5.6 Sol 发现 PHP 存在严重漏洞，若未及时修补可能危及全球约 70% 的网站，PHP 已紧急发布修复。两个漏洞的 CVSS 严重性评分均为 9.2，影响范围可追溯至 PHP 5.4 版本，攻击者无需账号即可接管 Web 服务器。Wiz 表示，这些模型让一名研究员在一周内完成了过去顶尖团队需要数月才能完成的工作；CVE 编号泄露迫使 PHP 提前一天发布补丁，Cloudflare 已报告早期攻击尝试。
推荐理由
AI 评分 85
原文披露了漏洞的技术成因与修复拖延背景，也给出 AI 辅助发现漏洞的效率对比。
主题
正文
当前显示原文，中文全文译文尚未就绪。
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”
> PHP rushed out fixes as it could let attackers without accounts take over web servers.
> Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4.
> When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack.
> Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack.
> Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months.
> A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.