PHP曝出隐藏十年严重漏洞 多国紧急敦促修补或断网下线Decade-Old Critical PHP Flaws Trigger Global Race to Patch or Disconnect

网络安全机构Wiz与Calif的研究团队在2026年8月对PHP源代码展开深度审计，借助来自OpenAI和谷歌的先进人工智能模型，识别出两项潜藏超过十年的高危安全隐患。OpenAI资助了Calif针对PHP代码库的安全审计项目，该机构表示这些缺陷代表AI开始展现挖掘互联网规模安全隐患的能力。长期研究PHP安全的专家瑞安·奥斯汀指出，自己起初仅凭直觉推测相关弱点，但在人工智能技术辅助下才得以完成实质突破，并称其为职业生涯中发现的最严重缺陷。

Security researchers at Wiz and Calif uncovered the two long-standing security weaknesses in August 2026 by applying advanced artificial intelligence models developed by OpenAI and Google to audit PHP's core codebase. Calif identified the flaws as part of an audit funded by OpenAI, which stated that the findings demonstrate the ability of artificial intelligence to surface software bugs with internet-scale consequences. Independent security researcher Ryan Austin, who has studied PHP for two decades, noted that uncovering the weaknesses started with an initial hunch he could not have pursued without AI assistance, calling it the most serious vulnerability he had ever found.

这两项漏洞经PHP官方团队评估，严重性评分均达到9.2分。萨里网络安全中心的艾伦·伍德沃德教授与香港信息科技商会荣誉会长方保侨指出，攻击者利用这些漏洞可在未经认证的情况下向服务器注入恶意代码并直接执行，进而窃取敏感数据、渗透内网其他设备，甚至植入常驻后门以长期控制受影响的主机系统。受影响的核心代码是支撑全球约70%网站处理用户表单、数据库交互与动态内容呈现的基础底层，导致数千万面向公网的服务器面临被恶意接管的风险。

Both vulnerabilities received an official severity rating of 9.2 out of 10 from the PHP development team. Prof Alan Woodward of the Surrey Centre for Cyber Security and Francis Fong Po-kiu of the Hong Kong Information Technology Federation explained that unauthenticated attackers exploiting the flaws can upload and execute arbitrary code on web servers, steal private data, pivot into wider internal networks, and plant persistent backdoors to retain remote control. Because the affected scripting engine handles form submissions, database connections, and real-time page rendering across roughly 70 percent of websites, millions of internet-facing servers were left exposed to direct administrative takeover.

漏洞详情公布后，欧美与亚太地区网络安全主管部门相继发布防御指引。美国网络安全和基础设施安全局表示，虽然截至通报发布时未观察到针对该缺陷的实际利用，但未修补系统面临直接风险。美国联邦调查局网络处与英国国家网络安全中心建议所有公共和私营机构立即实施修补，并明确提出若无法立即完成修复，应考虑将相关系统从网络中离线隔离，欧盟与澳大利亚的相关网络安全机构也发出了同样的修补呼吁。

Following the disclosure, cybersecurity authorities across Europe, North America, and the Asia-Pacific region issued synchronized emergency advisories. The United States Cybersecurity and Infrastructure Security Agency stated that although it had not observed active exploitation at the time of publication, unpatched systems faced direct danger. Both the Federal Bureau of Investigation's Cyber Division and Britain's National Cyber Security Centre urged public and private entities to deploy patches immediately, advising that organizations unable to remediate systems right away should consider taking them offline until mitigations are complete. Counterparts across the European Union and Australia echoed identical recommendations.

在亚洲，中国工业和信息化部要求各机构与用户立即对技术系统开展全面排查，升级至最新的安全版本，同时加强网络安全监测并及时更换账号、密码与密钥。中国香港电脑保安事故协调中心将该漏洞评定为“极高风险”，呼吁网站运营方立即安装补丁；该中心强调，若无法即刻修补，应将面向公网的应用程序与公共网络物理或逻辑隔离，直至安全修复程序安装并验证完毕。

In Asia, China's Ministry of Industry and Information Technology directed organizations and users to conduct an immediate, comprehensive inspection of their technical systems, upgrade to the latest secure release, bolster active monitoring, and update account credentials, passwords, and keys. The Hong Kong Computer Emergency Response Team Coordination Centre designated the vulnerability an extremely high risk and urged operators to patch immediately, stating that if immediate patching proved unfeasible, administrators should isolate internet-facing applications from public networks until security updates are applied and verified.

在官方发布离线隔离建议后，全球多地公共机构与网络服务迅速采取预防性关停措施。维基百科背后的维基媒体基金会主动下线了部分系统，荷兰国家网络安全机构也暂时关闭了自身官方网站。在欧洲，芬兰政府门户、法国巴黎警察局网站、日内瓦大学网站，以及包括爱丁堡市议会和医疗委员会在内的苏格兰多家公共管理机构站点相继宣告暂停访问。此外，从游戏娱乐平台到一款宝可梦睡眠监测应用，多种类型的互联网服务均在更新期间进入维护或离线状态。

Following emergency guidance to isolate vulnerable systems, public institutions and digital services around the world moved quickly to halt access as a precautionary measure. Wikimedia, the organization behind the Wikipedia online encyclopedia, took a number of its internal systems offline, while the Netherlands' national cyber-security agency pulled its own website. Across Europe, temporary service interruptions hit the Finnish government portal, the Paris police department site, and the University of Geneva. In Scotland, multiple public organizations—including Edinburgh City Council and regional health boards—shut down their websites, alongside disruptions to various gaming forums and a Pokemon sleep-tracking application.

企业网络防御前线同时监测到了针对该缺陷的异常流量。亚马逊表示，旗下威胁情报系统自周六起就识别到针对性活动，并在保密通报期结束后进一步侦测到了针对该漏洞的利用尝试；亚马逊称系统已自动阻断并限制了相关的恶意扫描行为。英国政府表示正在排查本国在线政务服务的潜在风险。部分网络安全专家指出，维护不善或缺乏专业安全资源的小型机构与个人站点，在面临自动化攻击探测时将承受更高的暴露风险。

Corporate infrastructure also came under active probing as defensive teams mobilized. Amazon revealed that its threat intelligence platform detected targeted activity starting Saturday, followed by live exploitation attempts once the flaw's disclosure embargo lifted, adding that automated defenses had detected and restricted malicious scanning attempts. The British government confirmed ongoing work to evaluate exposure across public online platforms. Cybersecurity experts cautioned that smaller entities with poorly maintained systems or limited security staff remain particularly vulnerable to rapid exploitation before patches are fully applied.

作为诞生于20世纪90年代初并自2000年代起广泛应用的编程语言，PHP被安全研究机构Wiz称为网络基石，在当代互联网深层架构中仍占据根深蒂固的位置。网络安全专家瑞安·奥斯汀指出，PHP属于构建早期互联网的第一代网页语言之一，存在于许多人们意想不到但对网络运行机制至关重要的核心环节。正因其与WordPress等内容管理框架深度绑定，该语言底层缺陷的暴露直接将数以千万计的站点推入防御真空。

Created in the early 1990s and widely adopted internationally since the 2000s, PHP was described by security research firm Wiz as a foundational backbone of the web that remains deeply entrenched across digital architecture. Cyber security researcher Ryan Austin observed that PHP was among the earliest programming languages powering the early internet, noting that it quietly persists in numerous unexpected locations essential to how the online world operates. Because platforms like WordPress rely directly on its engine, exposing flaws at this foundational layer placed tens of millions of websites into an immediate security dilemma.

此次事件同时激起了技术界对AI在网络攻防两端加速效应的深度忧虑。大猩猩网络安全公司首席执行官保罗·斯佩恩分析，人工智能技术可能促使黑客实施攻击变得更为容易且迅速。詹姆斯库克大学新加坡校区网络安全高级讲师史蒂夫·克里森对此发出警示，强调AI等工具的棘手之处在于一旦技术信息全面公开，各方能够极其快速地将其武器化；阿德莱德大学学者吉尔·斯莱也指出，若黑客或国家行为体将该漏洞武器化并借此掠夺网络私密数据，其破坏性后果将难以估量。

The episode has also ignited sharp concern across the cybersecurity industry regarding the accelerating role of artificial intelligence in offensive and defensive operations. Paul Spain, chief executive of Gorilla Cyber Security, cautioned that artificial intelligence tools could make attacks significantly faster and easier to deploy at scale. Steve Kerrison, a senior lecturer in cybersecurity at James Cook University's Singapore campus, warned that the principal trouble with such advanced models is that adversaries can weaponize vulnerability details very quickly once the technical data enters the public domain, a danger echoed by University of Adelaide researcher Jill Slay, who warned of disastrous fallout if malicious groups or nation-states weaponize the flaw to seize private data.