NSA 警告两个由 Calif 研究人员用 GPT-5.6 Sol 发现的 PHP 关键漏洞（PHP2Shell），敦促组织打补丁或将未修补服务器下线。两个漏洞位于 PHP 核心，在 Apache mod_php 上演示的利用可在应用代码运行前触发。
原文把 AI 发现的 PHP 漏洞与实际攻击、补丁版本和暴露面数字放在一起，读者可以据此评估这一事件的真实影响范围。
National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language
Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol
In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online.
The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline.
Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top.
When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust.
On Apache’s mod_php, a demonstrated exploit triggers the corruption before any application code runs, so logins and app-level checks cannot block it.
Cloudflare saw attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21.
VirusTotal counts about 5.1M IP addresses running PHP, and about 758K that show a version run end-of-life branches with no patched release.
That long tail will set how long PHP2Shell stays exploitable, since each owner must upgrade, find a backport or take the server offline.
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch. Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.” > PHP rushed out fixes as it could let attackers without accounts take over web servers. > Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4. > When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack. > Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack. > Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months. > A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.在 X 查看被引用的帖子
来源：Rohan Paul · x.com