PHP-ocalypse: How two critical web bugs almost broke the internet

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

On Wednesday, a decades-old open-source web technology called PHP almost broke the internet, thanks to two vulnerabilities that had sat dormant for years until researchers recently figured out a way to exploit them. The bugs are dubbed PHP2Shell, officially designated as CVE-2026-109618 and CVE-2026-109619.

周三，一种名为 PHP 的数十年历史的开源网络技术差点导致互联网瘫痪，原因是有两个漏洞在沉睡多年后，最近被研究人员发现了利用方法。这些漏洞被称为 PHP2Shell，官方编号为 CVE-2026-109618 和 CVE-2026-109619。

In simple terms, the bugs allow anyone who knows how to exploit them to break into an online system running PHP, such as a website or internet-facing server, without needing a password to access or modify its data. As situations go, this was a pretty sizable one, forcing millions of people around the world to scramble to patch their systems before malicious hackers could abuse them.

简单来说，这些漏洞允许任何知道如何利用它们的人入侵运行 PHP 的在线系统（例如网站或面向互联网的服务器），而无需密码即可访问或修改其数据。这种情况相当严重，迫使全球数百万人争分夺秒地修补系统，以防恶意黑客利用这些漏洞。

The PHP Foundation, which maintains the PHP web software, publicly released patches on Wednesday that fixed the bugs, which when installed prevent web-facing servers from being attacked. The foundation had already given some of the biggest internet companies and web hosts that rely on PHP an early headstart on patching.

维护 PHP 网络软件的 PHP 基金会于周三公开发布了修复这些漏洞的补丁，安装后可防止面向网络的服务器受到攻击。该基金会此前已经让一些依赖 PHP 的大型互联网公司和网络主机服务商提前开始了补丁安装工作。

Thanks to weeks of backroom chatter and careful coordination across the industry, the world — so far — broadly avoided mass internet exploitation. From Wednesday, governments began urging citizens and companies with websites to take action to mitigate the risks on their ends.

得益于数周的幕后沟通和行业内的精心协调，全球目前在很大程度上避免了大规模的互联网攻击。从周三开始，各国政府开始敦促公民和拥有网站的公司采取行动，以降低各自面临的风险。

A wide range of industries shuttered their websites and pulled services offline to patch their systems. Banks, retailers, gaming sites, online stores, hospitals, and some government agencies took down their servers to prevent attacks.

各行各业纷纷关闭网站并将服务下线以修补系统。银行、零售商、游戏网站、在线商店、医院以及一些政府机构都关闭了服务器以防止攻击。

But security researchers are warning that the situation isn’t over yet, and that a large number of systems around the world remain unpatched and vulnerable to hacks and data theft. This is also unlikely to be the last major internet software scare, with some expecting the advent of AI to rapidly uncover as-yet-undiscovered vulnerabilities that are waiting to be found and abused.

但安全研究人员警告称，情况尚未结束，全球仍有大量系统未打补丁，容易受到黑客攻击和数据窃取。这也不太可能是最后一次重大的互联网软件恐慌，一些人预计人工智能的出现将迅速揭示那些尚未被发现且等待被利用的漏洞。

What happened? Security researchers at Calif found two bugs in PHP, a programming language widely used around the world for building websites and web apps, both on the internet and hosted locally on company networks, like intranets and internal sites. PHP is open-source, meaning it’s free and available to be used by anyone for almost any reason. As such, it’s become one of the most popular and broadly used web programming languages on the web today.

发生了什么？Calif 的安全研究人员在 PHP 中发现了两个漏洞。PHP 是一种在全球范围内广泛用于构建网站和网络应用程序的编程语言，既可用于互联网，也可托管在公司内部网络（如内联网和内部站点）中。PHP 是开源的，这意味着任何人都可以免费将其用于几乎任何目的。因此，它已成为当今网络上最流行、使用最广泛的网络编程语言之一。

The two bugs were first discovered in 2024 but weren’t considered exploitable at the time, and weren’t patched. Security researchers recently found a way to exploit them, prompting them to alert the makers of the software to get them fixed. Calif alerted the PHP Foundation, which began a period of fixing the bugs and coordinated disclosure.

这两个漏洞最早于 2024 年被发现，但当时被认为无法利用，因此未进行修补。安全研究人员最近找到了利用它们的方法，促使他们提醒软件制造商进行修复。Calif 通知了 PHP 基金会，该基金会随后开始了漏洞修复和协调披露工作。

The foundation did this by offering the information and patches about the security issues under a tightly guarded embargo — essentially held confidentially until a specific deadline — to give big companies an opportunity to get ahead of installing the fixes.

该基金会通过在严格保密的情况下提供有关安全问题的信息和补丁（本质上是在特定截止日期前保密），让大公司有机会提前安装修复程序。

Why are the bugs so serious? PHP2Shell is pretty serious because it can be abused remotely over the internet and without the victim having to click on a link or open a file. This is known as remote code execution, and it’s one of the more damaging kinds of bugs to exploit because they can grant a hacker anywhere in the world effectively full control over an affected and unpatched system.

为什么这些漏洞如此严重？PHP2Shell 非常严重，因为它可以通过互联网远程滥用，且无需受害者点击链接或打开文件。这被称为远程代码执行，是危害性最大的漏洞类型之一，因为它们可以让世界各地的黑客有效地完全控制受影响且未打补丁的系统。

Worse, these specific PHP bugs make it possible to break into any unpatched system on the internet without needing a password or any other credential over the internet, known as unauthenticated access. This would allow a malicious hacker to then plant malware on the computer, such as to steal data or simply to maintain a long-term foothold that they can return to later.

更糟糕的是，这些特定的 PHP 漏洞使得在无需密码或其他凭据的情况下，即可通过互联网入侵互联网上任何未打补丁的系统，这被称为未经身份验证的访问。这将允许恶意黑客在计算机上植入恶意软件，例如窃取数据或仅仅是维持一个可以随时返回的长期立足点。

Why was 70% of the web affected? The bugs are particularly risky because PHP is wildly popular software, in part because it’s free and relatively easy to use, but also because it’s been around for decades. Around 70% of the web-facing internet relies on PHP, though its usage has been slowly declining over the years in favor of newer, more secure programming languages.

为什么 70% 的网络受到影响？这些漏洞风险极大，因为 PHP 是一款非常流行的软件，部分原因是它免费且相对易于使用，但也因为它已经存在了几十年。大约 70% 的面向互联网的网络依赖于 PHP，尽管多年来其使用率一直在缓慢下降，转而使用更新、更安全的编程语言。

Given its popularity, some of the world’s most popular websites are run on web software that rely on PHP, such as WordPress (which hosts TechCrunch!), as well as Drupal, Joomla, and MediaWiki, which powers online encyclopedia giant Wikipedia.

鉴于其普及程度，世界上一些最受欢迎的网站都是在依赖 PHP 的网络软件上运行的，例如 WordPress（TechCrunch 的托管平台！），以及 Drupal、Joomla 和为在线百科全书巨头维基百科提供支持的 MediaWiki。

PHP is just one of many aging but functional technologies that have survived waves of the internet and generations that are now so ubiquitous, they’re akin to the glue that holds much of the internet together. Oftentimes these tools are developed by open source maintainers, who are not paid for the work that they do, and as such cannot afford third-party security reviews — but are still widely relied on by companies who do not contribute financially to the projects.

PHP 只是众多虽老旧但功能依然强大的技术之一，它们在互联网的浪潮和代际更迭中幸存下来，如今已无处不在，就像将互联网大部分内容粘合在一起的胶水。这些工具通常由开源维护者开发，他们没有报酬，因此无法负担第三方安全审查，但那些并未在经济上为这些项目做出贡献的公司却仍然广泛依赖它们。

Was AI used to discover the bugs? Security researchers at Calif were credited with discovering the bugs earlier this year as part of a security audit of PHP’s code. Calif was participating in the Hack the Planet initiative by AI model maker OpenAI and cloud security giant Wiz, which subsequently verified the proof-of-concept exploits that Calif made.

人工智能是否被用于发现这些漏洞？Calif 的安全研究人员因在今年早些时候对 PHP 代码进行安全审计时发现这些漏洞而受到赞誉。Calif 当时正在参与由人工智能模型制造商 OpenAI 和云安全巨头 Wiz 发起的“Hack the Planet”计划，后者随后验证了 Calif 制作的概念验证漏洞利用程序。

In Calif’s write-up (featuring comics — it’s great, check it out), the researchers explained that AI was used in assistance with exploiting the bug, but that the bulk of the work relied on knowledge that the researchers already had, and that they knew PHP’s codebase and exploitation history well. “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,” wrote Calif.

在 Calif 的报告中（配有漫画，非常棒，值得一看），研究人员解释说，人工智能被用于辅助利用该漏洞，但大部分工作依赖于研究人员已有的知识，以及他们对 PHP 代码库和利用历史的深入了解。Calif 写道：“至少目前，没有任何模型能够仅通过简单的提示就挖掘出‘所有漏洞’。”

Why were the bugs exploited ahead of disclosure? Despite efforts to keep details of the bugs under wraps until…

为什么这些漏洞在披露前就被利用了？尽管各方努力将漏洞细节保密，直到……