AI is forcing us to pay off 40 years of technical debt

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

The November issue of IEEE Spectrum is here!

《IEEE Spectrum》十一月刊现已发布！

AI is forcing us to pay off 40 years of technical debt. Dina Genkina is the computing and hardware editor at IEEE Spectrum.

人工智能正迫使我们偿还四十年的技术债务。Dina Genkina 是《IEEE Spectrum》的计算与硬件编辑。

In late October, a slew of major cybersecurity issues came to light. But none were bigger than the so-called PHP2Shell vulnerability, which put a plethora of websites, including those of NASA, Wikipedia, the White House, and all other sites that run on Wordpress or Drupal (among others) at risk of exploits capable of both reading sensitive data and running malicious code on the host server.

十月下旬，一系列重大的网络安全问题浮出水面。其中最严重的莫过于所谓的“PHP2Shell”漏洞，它使包括美国国家航空航天局（NASA）、维基百科、白宫以及所有运行 WordPress 或 Drupal 等系统的网站在内的大量网站面临风险，攻击者不仅能读取敏感数据，还能在主机服务器上运行恶意代码。

As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation, and a patch was released before any bad actors got their hands on the exploit. However, PHP2Shell may be the canary in the coal mine, serving as a warning sign for what’s to come in the age of AI.

据目前所知，灾难已被避免：该漏洞由网络安全研究人员发现并报告给了 PHP 基金会，在恶意攻击者利用该漏洞之前，补丁就已经发布。然而，PHP2Shell 可能只是“煤矿里的金丝雀”，为人工智能时代即将到来的风险敲响了警钟。

“One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed,” says Matt Suiche, AI security research lead at the cybersecurity startup Tolmo. “Now it is time for the technical debt to be paid off.”

网络安全初创公司 Tolmo 的人工智能安全研究主管 Matt Suiche 表示：“我们现在目睹的情况之一是，过去 40 年里由人类编写的所有遗留软件正面临暴露。现在是偿还技术债务的时候了。”

PHP, which originally stood for “personal home page,” is a programming language created back in 1994 and largely used by legacy sites. The bug underlying the PHP2Shell vulnerability was reported to the PHP Foundation as far back as 2024. The bug caused a common type of issue called an out-of-memory error, in which the amount of memory allocated to a piece of data is too small to hold the data. Normally, this type of error causes the program to crash—an unpleasant but not inherently dangerous result. And so the bug remained unaddressed.

PHP 最初代表“个人主页”（personal home page），是一种创建于 1994 年的编程语言，主要用于遗留网站。PHP2Shell 漏洞背后的错误早在 2024 年就被报告给了 PHP 基金会。该错误导致了一种常见的“内存溢出”问题，即分配给某段数据的内存空间不足以容纳该数据。通常情况下，这类错误只会导致程序崩溃——虽然令人不快，但本质上并不危险。因此，该漏洞一直未得到解决。

“If you look at any at any point of time, there will be a bunch of bug reports that are waiting to be fixed, which are just crashes. Most people don’t take them very seriously,” says Suman Jana, an associate professor of computer science at Columbia University.

哥伦比亚大学计算机科学副教授 Suman Jana 说：“如果你在任何时间点查看，都会发现有一堆等待修复的错误报告，它们仅仅会导致崩溃。大多数人并不太在意这些问题。”

“It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.” –Suman Jana, Columbia University

“这只是需要进行大量非常具体的推理，过程很痛苦。而我认为，人工智能在这方面做得非常好。”——Suman Jana，哥伦比亚大学

Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a researcher at Calif, aided by AI tools, found a way to use the out-of-memory bug to run arbitrary code on the host server, allowing a malicious actor to install malware or read critical data. Now, it was no longer a minor bug—it was a critical vulnerability, and the Calif team alerted the PHP foundation to start working on a patch immediately.

今年早些时候，网络安全公司 Calif 在 OpenAI 的赞助下，主动提出对 PHP 进行独立审计。在两周内，Calif 的一名研究人员在人工智能工具的辅助下，找到了一种利用该内存溢出错误在主机服务器上运行任意代码的方法，使恶意攻击者能够安装恶意软件或读取关键数据。此时，这已不再是一个小错误，而是一个严重漏洞，Calif 团队随即提醒 PHP 基金会立即着手开发补丁。

Jana says actually exploiting the bug requires carefully working out a way to jump to a specific point in the memory for a particular program running on the server, and work out exactly which bits to overwrite in what order to gain control of the system. “It’s not really rocket science,” he says. “It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.”

Jana 表示，实际利用该漏洞需要仔细计算如何跳转到服务器上特定程序内存中的某个点，并精确计算出以何种顺序覆盖哪些位才能获得系统控制权。“这并不是什么高深的技术，”他说，“只是需要进行大量非常具体的推理，过程很痛苦。而我认为，人工智能在这方面做得非常好。”

To be clear, the researchers at Calif (as well as OpenAI and Wiz, a cybersecurity company that confirmed and expanded the vulnerabilities) had deep knowledge of both cybersecurity and the PHP language. “I’m not claiming that AI can do it all by itself. It clearly cannot,” Jana says. “But it is improving a lot, so the top 0.1 percent [of experts] can get a lot more stuff done, and also just below the 0.1 percent now will be able to go there without understanding all the nitty-gritty details.”

需要明确的是，Calif（以及确认并扩展了这些漏洞的网络安全公司 OpenAI 和 Wiz）的研究人员对网络安全和 PHP 语言都有着深厚的了解。Jana 说：“我并不是说人工智能可以独立完成这一切。显然它做不到。但它正在大幅进步，使得顶尖的 0.1% 的专家能完成更多工作，同时也让那些稍逊于顶尖水平的人，在无需完全理解所有细节的情况下也能做到这一点。”

After the exploits were disclosed to the PHP Foundation, a team of four engineers spent two months developing a patch to release as quickly as possible.

在漏洞披露给 PHP 基金会后，一个由四名工程师组成的团队花了两个月时间开发补丁，以便尽快发布。

“There is a fundamental asymmetry in finding bugs and fixing bugs,” Jana says. “Because when you’re fixing bugs you have to make sure that you know all parts of that attack are closed, and also that you don’t break any existing functionality.”

“在发现漏洞和修复漏洞之间存在根本性的不对称，”Jana 说，“因为当你修复漏洞时，你必须确保攻击的所有路径都被堵死，同时还要确保不会破坏任何现有的功能。”

This asymmetry puts a lot of strain on the defenders, especially for open-source software such as PHP. Maintaining open-source projects that don’t have clear revenue streams despite being widely used is a long-standing challenge that precedes AI hacking tools. But those tools make the issue more pressing than ever.

这种不对称给防御者带来了巨大压力，尤其是对于像 PHP 这样的开源软件而言。维护那些虽然被广泛使用但缺乏明确收入来源的开源项目，是一个在人工智能黑客工具出现之前就已存在的长期挑战。但这些工具使这一问题变得比以往任何时候都更加紧迫。

One way to stay ahead of such issues going forward is to empower the defenders with more money and access to frontier cybersecurity AI models. “These frontier labs are donating some of their token budgets to look into these bugs, which I think is great,” Jana says. “I think that should happen more, either through some concerted effort or through donations.”

未来应对此类问题的一种方法是为防御者提供更多资金，并让他们能够使用前沿的网络安全人工智能模型。Jana 说：“这些前沿实验室正在捐赠部分代币预算来研究这些漏洞，我认为这很好。我认为应该有更多这样的行动，无论是通过协同努力还是通过捐赠。”

Jana is also optimistic that formal verification tools to automate the patching side of the equation are also advancing quickly, including a new release from Anthropic on 22 October. “The patch is LLM-generated, and then an LLM generates the proof that the patch is correct,” says Jana. “The only thing not done by an LLM is the proof checker, because somebody has to check the proof, because LLMs hallucinate. So, you want something that is formal.”

Jana 还乐观地认为，用于实现补丁自动化修复的形式化验证工具也在快速进步，包括 Anthropic 在 10 月 22 日发布的新成果。Jana 说：“补丁是由大语言模型（LLM）生成的，然后由大语言模型生成证明该补丁正确的证据。唯一不是由大语言模型完成的部分是证明检查器，因为必须有人来检查证明，毕竟大语言模型会产生幻觉。所以，你需要一些形式化的东西。”

Hopefully, the combination of specialized AI models and formal verification tools will make patching vulnerabilities nearly as automatable as finding them.

希望专业人工智能模型与形式化验证工具的结合，能使漏洞修复变得像漏洞发现一样实现近乎自动化。

Matthew Green, an associate professor of computer science at Johns Hopkins University Information Security Institute, is less optimistic. “Nobody’s going to fix this problem until something really bad happens,” he says. “And PHP2Shell wasn’t bad enough to be really bad. So when something really bad happens, which is going to be maybe sometime in early 2027, something bad that normal people are upset by, then suddenly people will start doing this. We’re going to fund everything.”

约翰霍普金斯大学信息安全研究所计算机科学副教授 Matthew Green 则不那么乐观。他说：“除非发生真正糟糕的事情，否则没人会去解决这个问题。而 PHP2Shell 还不够糟糕。所以，当真正糟糕的事情发生时——可能在 2027 年初的某个时候，发生一些让普通民众感到不安的严重事件——人们才会突然开始行动。届时我们将为一切提供资金。”

In the meantime, Green says, update your software. “If your phone is like, ‘Hey, there’s a security update available, do you want to install it,’ don’t wait till next week. Just do it.”

与此同时，Green 建议大家更新软件。“如果你的手机提示‘嘿，有安全更新可用，是否要安装’，不要等到下周。现在就安装。”

One thing’s for sure—PHP2Shell is just the beginning. “This won’t be the last one for s

有一点是肯定的——PHP2Shell 仅仅是个开始。“这不会是最后一个……”