本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

PHP: The three letters that shut down sites all over the internet today

OpenAI is taking credit for finding the PHP2Shell vulnerabilities, but now someone has to apply all these patches.

OpenAI 正在为发现 PHP2Shell 漏洞邀功，但现在必须有人来应用所有这些补丁。

Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people’s dogs. The “critical vulnerabilities” were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress.

今天，4chan、DeviantArt、维基百科以及街角酒吧发布狗狗照片的博客所面临的重大问题，其背后是两个通过人工智能发现的漏洞。这些“严重漏洞”是在 PHP 编程语言中发现的，该语言支撑着互联网的大部分内容，包括任何基于 WordPress 构建的网站。

But it’s far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if “an immediate update is not feasible,” as did the UK’s National Cyber Security Center. Even Pokémon Home and Pokémon Champions were taken offline, Kotaku reports.

但情况远不止于此。一些荷兰和芬兰的政府机构出于预防措施关闭了他们的网站。X 平台上的美国国家安全局（NSA）网络安全账号建议，如果“无法立即更新”，各组织应将系统下线，英国国家网络安全中心也提出了同样的建议。据 Kotaku 报道，甚至连 Pokémon Home 和 Pokémon Champions 也已下线。

The vulnerability isn’t exactly new. It’s been present in PHP for roughly 20 years, but exploiting it “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” according to security firm Wiz. However, powerful AI models have made it much easier to turn that kind of obscure bug into dangerous vulnerabilities.

该漏洞并非完全是新的。据安全公司 Wiz 称，它在 PHP 中已经存在了大约 20 年，但利用它“需要极其复杂的步骤链，处于人类研究人员实际能够实现的边缘”。然而，强大的人工智能模型使得将这种晦涩的漏洞转化为危险的漏洞变得容易多了。

As a casual internet user, you might be wondering what exactly the barrage of jargon like “RCE via OOM corruption” means, how concerned you should be, and how exactly a vulnerability this severe flew under the radar for so long.

作为一名普通互联网用户，你可能想知道像“通过 OOM 损坏实现 RCE”这样的一连串术语到底是什么意思，你应该有多担心，以及这样一个严重的漏洞究竟是如何在这么长时间里未被发现的。

What is PHP? W3Techs, a survey service, says that the PHP programming language is used by “69.3 percent of all the websites whose server-side programming language we know,” including popular sites like Wikipedia and WordPress. The internet security site VirusTotal says its scanner currently registers about 3.8 million sites running PHP with at least one port open.

什么是 PHP？调查服务机构 W3Techs 表示，在所有已知服务器端编程语言的网站中，有“69.3%”使用 PHP 编程语言，其中包括维基百科和 WordPress 等热门网站。互联网安全网站 VirusTotal 表示，其扫描器目前登记了约 380 万个运行 PHP 且至少开放一个端口的网站。

What happened? According to OpenAI, an AI security group called Calif identified a “critical” PHP flaw using GPT-5.6 Sol, and Google-owned Wiz independently discovered and reported the vulnerabilities using AI. The PHP Foundation says that an exploit for one of the vulnerabilities “was theorized” in 2024, but “no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.”

发生了什么？据 OpenAI 称，一个名为 Calif 的人工智能安全小组使用 GPT-5.6 Sol 识别出了一个“严重”的 PHP 缺陷，而谷歌旗下的 Wiz 也利用人工智能独立发现并报告了这些漏洞。PHP 基金会表示，其中一个漏洞的利用方式在 2024 年就“被理论化”了，但“没有发现具体的攻击向量，其他具有明确影响的具体问题掩盖了这些担忧。”

Now the PHP Group says hackers could use the two vulnerabilities for “unauthenticated remote code execution,” like running their own code, changing content, and accessing a site’s stored data without needing an administrator login or password.

现在，PHP 小组表示，黑客可以利用这两个漏洞进行“未经身份验证的远程代码执行”，例如运行他们自己的代码、更改内容以及在无需管理员登录名或密码的情况下访问网站存储的数据。

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

通过 OOM 损坏实现 RCE，CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)：内存不足处理可能会在内部请求数据仅部分初始化时中断 PHP。请求清理程序随后可能会将无效数据视为有效数据。

RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

通过陈旧全局状态实现 RCE，CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)：请求拥有的内部状态在支持内存被释放后仍可能存活。由同一工作进程处理的后续请求可能会在正常初始化重置它之前使用该陈旧状态。

How serious is it? Very. The PHP Group says that basically any site running PHP is at risk. OpenAI, which was involved in the vulnerability research, said: “We consider this one of the most impactful security issues in recent memory.” And Wiz said it’s “among the most severe vulnerabilities discovered … in software history.”

它有多严重？非常严重。PHP 小组表示，基本上任何运行 PHP 的网站都面临风险。参与漏洞研究的 OpenAI 表示：“我们认为这是近期记忆中最具影响力的安全问题之一。”而 Wiz 则称其为“软件历史上发现的最严重的漏洞之一”。

Last night, the CTO of Cloudflare said that it was “seeing early attacks emerging.” It’s hard to understate just how bad this could get. The vulnerabilities could allow an attacker to take full control of a server. That includes gaining access to passwords, API keys, cryptographic certificates, and databases of sensitive information. They could also execute code on those servers, turning them into vectors to attack other vulnerable servers. And, thanks to AI, it’s relatively trivial for a determined hacker to exploit these flaws now that they have been revealed.

昨晚，Cloudflare 的首席技术官表示，他们“已经看到早期攻击出现”。很难低估这可能带来的严重后果。这些漏洞可能允许攻击者完全控制服务器。这包括获取密码、API 密钥、加密证书和敏感信息数据库的访问权限。他们还可以在这些服务器上执行代码，将其变成攻击其他易受攻击服务器的载体。而且，多亏了人工智能，对于一个坚定的黑客来说，在这些漏洞被揭露后利用它们相对简单。

What can I do? As a user, not much. The vulnerability affects servers running PHP and doesn’t necessarily target users directly, but it could use compromised sites to spread malware and steal other valuable data. If you’re feeling extra cautious, check the social accounts of sites and services you frequently use to see if they’ve posted any updates before visiting.

我能做什么？作为用户，能做的并不多。该漏洞影响运行 PHP 的服务器，并不一定直接针对用户，但它可能会利用受感染的网站传播恶意软件并窃取其他有价值的数据。如果你特别谨慎，请在访问之前查看你经常使用的网站和服务的社交账号，看看它们是否发布了任何更新。

If you have a website, even a simple blog, it’s time to check what version of PHP your site uses, if any. If you’re using a service like Squarespace or Wix, you’re in the clear, as those don’t support PHP.

如果你有一个网站，即使是一个简单的博客，现在也是时候检查你的网站使用了什么版本的 PHP（如果有的话）。如果你使用的是 Squarespace 或 Wix 等服务，那么你是安全的，因为这些服务不支持 PHP。

Customers of Hostinger, GoDaddy, Bluehost, or other web hosting services should be more cautious. GoDaddy says that any site using PHP should assume it is affected and update to the fixed release as soon as possible. It also says that sites running PHP 8.1 or older should upgrade to a newer version, as they’re no longer supported and there will not be an official fix coming.

Hostinger、GoDaddy、Bluehost 或其他网络托管服务的客户应该更加谨慎。GoDaddy 表示，任何使用 PHP 的网站都应假设自己受到影响，并尽快更新到修复版本。它还表示，运行 PHP 8.1 或更旧版本的网站应升级到更新的版本，因为它们已不再受支持，也不会有官方修复程序发布。

Those on a managed hosting service should check with their provider to see when they should expect the fix to be deployed. If you sell products or services or have any sensitive data on your servers at all, it’s best to disable your site until your host patches their version of PHP.

使用托管服务的人应咨询其服务提供商，了解预计何时部署修复程序。如果你销售产品或服务，或者服务器上有任何敏感数据，最好在主机商修补其 PHP 版本之前禁用你的网站。