NSA 警告 PHP 两个 CVSS 9.2 级核心漏洞 PHP2Shell，要求组织尽快修复或将未修复服务器下线。
原文汇总了 PHP2Shell 漏洞的关键细节和受影响规模，读者可以借此了解 AI 发现漏洞在真实世界的落地影响。
National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language
Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol
In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online.
The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline.
Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top.
When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust.
On Apache’s mod_php, a demonstrated exploit triggers the corruption before any application code runs, so logins and app-level checks cannot block it.
Cloudflare saw attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21.
VirusTotal counts about 5.1M IP addresses running PHP, and about 758K that show a version run end-of-life branches with no patched release.
That long tail will set how long PHP2Shell stays exploitable, since each owner must upgrade, find a backport or take the server offline.
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch. Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.” > PHP rushed out fixes as it could let attackers without accounts take over web servers. > Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4. > When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack. > Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack. > Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months. > A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.在 X 查看被引用的帖子
来源：Rohan Paul · x.com