{ "version": 1, "event_id": "evt_4eb800807f88fccc", "url": "https://xiyu.news/events/evt_4eb800807f88fccc/", "json": "https://xiyu.news/api/events/evt_4eb800807f88fccc.json", "type": "security_incident", "status": "developing", "category": "technology", "title": { "zh": "PHP披露两个严重远程代码执行漏洞并发布紧急补丁", "en": "PHP discloses two critical RCE vulnerabilities and releases emergency patches" }, "current_state": { "zh": "Cloudflare 报告称，针对两个关键 PHP 漏洞的利用尝试达数百万次，其中数千次发生在公开披露之前；此前 PHP 基金会发布了紧急补丁，并承认资源短缺导致修复延迟。", "en": "Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix." }, "first_seen_at": "2026-10-21T06:41:27.640635+00:00", "last_updated_at": "2026-10-22T09:33:29.101363+00:00", "last_material_change_at": "2026-10-22T09:33:29.101363+00:00", "confidence": 0.75, "updates_count": 16, "sources_count": 25, "entities": [ "alert", "bug", "bugs", "ceo", "chatgpt", "cloudflare", "course", "critical", "cvss", "everyone", "found", "foundation", "freaking", "github", "global", "governments", "how", "internet", "made", "node", "nodejs", "nvdb", "openai", "out", "panic", "php", "php2shell", "put", "rce", "release", "remotely", "risk", "security-release", "slowmist", "spark", "strengthening", "that", "their", "today", "two", "unplug", "updated", "vulnerabilities", "warns", "websites", "who", "wordpress" ], "identifiers": [ "cve-2026", "cve-2026-109618", "cve-2026-109619" ], "topics": [ "ai-security", "cloudflare", "cloudflare-waf", "coordinated-disclosure", "critical-infrastructure", "cve", "cyberattack", "cybersecurity", "disclosure", "embargo", "emergency-patch", "exchanges", "exploitation", "financial-institutions", "frontier-models", "go", "government-websites", "infrastructure-security", "internet-infrastructure", "japan", "nodejs", "nvdb", "open-source", "openai", "patch-management", "patching", "php", "php-vulnerability", "rce", "remote-code-execution", "security-advisories", "security-advisory", "security-patching", "security-release", "slowmist", "tencent-cloud", "vulnerabilities", "vulnerability", "vulnerability-disclosure", "vulnerability-discovery", "web-infrastructure", "web-security", "white-house", "wordpress" ], "updates": [ { "update_id": "upd_8d92b4b6061acfbb", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T02:52:37Z", "published_at": "2026-10-21T02:52:37Z", "first_seen_at": "2026-10-21T06:41:27.640635Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "【慢雾：PHP 存在两个严重安全漏洞，建议相关团队排查使用 PHP 的服务器及业务系统】", "title_en": "【慢雾：PHP 存在两个严重安全漏洞，建议相关团队排查使用 PHP 的服务器及业务系统】", "what_changed_zh": "SlowMist 警告 PHP 存在两个 CVSS 9.2 的关键漏洞，可能允许远程代码执行，敦促各团队审计基于 PHP 的服务器和业务系统，并应用定于北京时间 10 月 21 日 22:00 发布的官方补丁。", "what_changed_en": "SlowMist warned that PHP contains two critical CVSS 9.2 vulnerabilities potentially allowing remote code execution, urging teams to audit PHP-based servers and business systems and to apply the official patch scheduled for release at 22:00 Beijing time on October 21.", "current_state_zh": "SlowMist 警告 PHP 存在两个 CVSS 9.2 的关键漏洞，可能允许远程代码执行，敦促各团队审计基于 PHP 的服务器和业务系统，并应用定于北京时间 10 月 21 日 22:00 发布的官方补丁。", "current_state_en": "SlowMist warned that PHP contains two critical CVSS 9.2 vulnerabilities potentially allowing remote code execution, urging teams to audit PHP-based servers and business systems and to apply the official patch scheduled for release at 22:00 Beijing time on October 21.", "detailed_summary_zh": "SlowMist warned that PHP contains two critical CVSS 9.2 vulnerabilities potentially allowing remote code execution, urging teams to audit PHP-based servers and business systems and to apply the official patch scheduled for release at 22:00 Beijing time on October 21.", "detailed_summary_en": "SlowMist warned that PHP contains two critical CVSS 9.2 vulnerabilities potentially allowing remote code execution, urging teams to audit PHP-based servers and business systems and to apply the official patch scheduled for release at 22:00 Beijing time on October 21.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120887", "telegram:theblockbeats:201532", "telegram:theblockbeats:201585", "telegram:theblockbeats:201693", "telegram:theblockbeats:201701", "telegram:wublockchainenglish:26504", "telegram:theblockbeats:201712", "telegram:theblockbeats:201713", "rss:decrypt.co_feed:aec50285ad7ab8bd" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115607", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/372873?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/372928?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/373037?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/373045?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://wublockchain.xyz/news/news-21334", "label": "wublockchainenglish", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/373056?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/373057?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://decrypt.co/381519/php-panic-critical-bugs-70-percent-internet-risk-everyone-freaking-out", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e845ca1c39b3e5a3", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T13:43:19Z", "published_at": "2026-10-21T13:43:19Z", "first_seen_at": "2026-10-21T17:31:51.266691Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "PHP2Shell：AI 发现 PHP 中的关键 RCE", "title_en": "PHP2Shell: AI uncovers critical RCE in PHP", "what_changed_zh": "Wiz 公开披露 PHP2Shell 技术细节：多个 PHP 核心漏洞（含 RCE、释放后使用、OPcache 类型混淆等）映射到两个 CVE，并提供针对 WordPress、Drupal、Joomla 的概念验证利用，且披露过程涉及 AI 辅助发现。", "what_changed_en": "Wiz publicly disclosed technical details of PHP2Shell: multiple PHP core flaws (including RCE, use-after-free, and OPcache type confusion) mapped to two CVEs, with proof-of-concept exploits against WordPress, Drupal, and Joomla, and AI-assisted discovery in the disclosure process.", "current_state_zh": "PHP2Shell 漏洞的技术细节与概念验证利用已公开，利用风险上升；官方补丁仍按计划准备发布，需紧急排查和缓解。", "current_state_en": "Technical details and proof-of-concept exploits for PHP2Shell are now public, increasing exploitation risk; the official patch remains scheduled for release and urgent mitigation is required.", "detailed_summary_zh": "Wiz disclosed PHP2Shell, a set of critical PHP core vulnerabilities including remote code execution and use-after-free flaws, with proof-of-concept exploits against WordPress, Drupal, and Joomla and notable AI-assisted discovery.", "detailed_summary_en": "Wiz disclosed PHP2Shell, a set of critical PHP core vulnerabilities including remote code execution and use-after-free flaws, with proof-of-concept exploits against WordPress, Drupal, and Joomla and notable AI-assisted discovery.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [ { "url": "https://news.ycombinator.com/item?id=50180836", "title": "Community discussion" } ], "confidence": 0.9, "story_ids": [ "hackernews:story:50180836" ], "sources": [ { "url": "https://www.wiz.io/blog/php2shell-php-rce", "label": "danlark1", "source_type": "hackernews", "official": false } ] }, { "update_id": "upd_5b4fab53ffff87a4", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T13:45:33Z", "published_at": "2026-10-21T13:45:33Z", "first_seen_at": "2026-10-21T14:11:35.217684Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "更新版 PHP 已发布至 GitHub", "title_en": "Updated PHP version released to GitHub", "what_changed_zh": "PHP 8.2.35 已发布至 GitHub，作为与 Wiz、Calif 和 OpenAI 协调披露的关键 RCE（“php2shell”）的修复版本，社区成员指出该发布提交似乎与任何分支脱钩。", "what_changed_en": "PHP 8.2.35 was published to GitHub as the fix release for a critical RCE ('php2shell') disclosed in coordination with Wiz, Calif and OpenAI, with community members noting the release commit appears detached from any branch.", "current_state_zh": "PHP 8.2.35 已发布至 GitHub，作为与 Wiz、Calif 和 OpenAI 协调披露的关键 RCE（“php2shell”）的修复版本，社区成员指出该发布提交似乎与任何分支脱钩。", "current_state_en": "PHP 8.2.35 was published to GitHub as the fix release for a critical RCE ('php2shell') disclosed in coordination with Wiz, Calif and OpenAI, with community members noting the release commit appears detached from any branch.", "detailed_summary_zh": "PHP 8.2.35 was published to GitHub as the fix release for a critical RCE ('php2shell') disclosed in coordination with Wiz, Calif and OpenAI, with community members noting the release commit appears detached from any branch.", "detailed_summary_en": "PHP 8.2.35 was published to GitHub as the fix release for a critical RCE ('php2shell') disclosed in coordination with Wiz, Calif and OpenAI, with community members noting the release commit appears detached from any branch.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [ { "url": "https://news.ycombinator.com/item?id=50180873", "title": "Community discussion" } ], "confidence": 0.75, "story_ids": [ "hackernews:story:50180873" ], "sources": [ { "url": "https://github.com/php/php-src/releases/tag/php-8.2.35", "label": "tuyuri", "source_type": "hackernews", "official": false } ] }, { "update_id": "upd_53640e356fca41cc", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T14:25:02Z", "published_at": "2026-10-21T14:25:02Z", "first_seen_at": "2026-10-21T17:31:49.740486Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "PHP曝出严重安全漏洞，欧洲多国政府网站大规模下线", "title_en": "PHP曝出严重安全漏洞，欧洲多国政府网站大规模下线", "what_changed_zh": "PHP 修复漏洞的新版本已正式发布；同时有报道称黑客正利用漏洞入侵网站，荷兰、芬兰等多国政府、医院及港口网站已预防性下线并紧急修补。", "what_changed_en": "A new PHP version with fixes has been officially released; meanwhile, reports of active exploitation led multiple European government, hospital, and port websites in countries including the Netherlands and Finland to be precautionarily taken offline and emergency patched.", "current_state_zh": "PHP 漏洞补丁已正式发布，但活跃利用报告和欧洲多国关键网站预防性下线表明风险与影响正在扩大，相关系统需立即更新和缓解。", "current_state_en": "The PHP patch has now been officially released, but reports of active exploitation and precautionary takedowns of multiple European critical websites indicate expanding risk and impact; urgent updating and mitigation are required.", "detailed_summary_zh": "Two critical PHP vulnerabilities triggered emergency patching and the precautionary takedown of multiple European government, hospital, and port websites amid reports of active exploitation.", "detailed_summary_en": "Two critical PHP vulnerabilities triggered emergency patching and the precautionary takedown of multiple European government, hospital, and port websites amid reports of active exploitation.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.94, "story_ids": [ "telegram:theblockbeats:201691" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373035?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_4c0aad3e8adc88bb", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T14:47:02Z", "published_at": "2026-10-21T14:47:02Z", "first_seen_at": "2026-10-21T17:31:49.743454Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "OpenAI复盘PHP漏洞风波：秘密协调两个月，却被论坛提前泄密", "title_en": "OpenAI复盘PHP漏洞风波：秘密协调两个月，却被论坛提前泄密", "what_changed_zh": "OpenAI 复盘披露：该 PHP 漏洞由 AI 模型辅助发现，OpenAI 牵头进行了约两个月的秘密协调；原计划 10 月 22 日公开，但 10 月 20 日 Hacker News 论坛提前泄露漏洞编号、严重程度和披露时间，迫使 PHP 提前发布警报并将补丁发布日期提前一天；修复涉及近 200 个文件、超过 1 万行代码。", "what_changed_en": "OpenAI's retrospective disclosed that the PHP vulnerabilities were found with AI model assistance and that OpenAI led roughly two months of secret coordination; disclosure was planned for Oct 22 but a Hacker News forum leak on Oct 20 exposed the CVE details, severity and disclosure timing, forcing PHP to issue an early alert and move the patch release up by one day; the fix touched nearly 200 files and more than 10,000 lines of code.", "current_state_zh": "PHP 已于 10 月 21 日发布修复版本；OpenAI 复盘确认 AI 辅助发现和两个月协调过程，并披露论坛提前泄密迫使 PHP 提前警报、补丁发布提前一天，Cloudflare 已观察到早期攻击尝试，部分政府网站主动下线避险。", "current_state_en": "PHP released fixes on Oct 21; OpenAI's retrospective confirms the AI-assisted discovery and two-month coordination, and discloses that an early forum leak forced PHP to issue an early alert and move the patch release up by one day, while Cloudflare observed early attack attempts and some government sites proactively went offline.", "detailed_summary_zh": "OpenAI detailed how AI models helped uncover decade-old critical PHP vulnerabilities, leading to a two-month coordinated patch effort that was disrupted by an early forum leak and ended with PHP releasing fixes on Oct 21 as attack attempts emerged.", "detailed_summary_en": "OpenAI detailed how AI models helped uncover decade-old critical PHP vulnerabilities, leading to a two-month coordinated patch effort that was disrupted by an early forum leak and ended with PHP releasing fixes on Oct 21 as attack attempts emerged.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.9, "story_ids": [ "telegram:theblockbeats:201697" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373040?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_80d4fdb388dd8f24", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T15:29:02Z", "published_at": "2026-10-21T15:29:02Z", "first_seen_at": "2026-10-21T17:31:49.747277Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "⚡️美国白宫：10月16日已获悉PHP漏洞，正协调加快修复补丁发布", "title_en": "⚡️美国白宫：10月16日已获悉PHP漏洞，正协调加快修复补丁发布", "what_changed_zh": "美国白宫表示已于10月16日获悉PHP安全漏洞，正与联邦机构及系统集成实验室协调加快修复补丁发布，并评估漏洞对政府系统和关键基础设施的潜在影响。", "what_changed_en": "The White House said it learned of the PHP vulnerability on October 16 and is coordinating with federal agencies and system integration labs to accelerate patch release and assess potential impacts on government systems and critical infrastructure.", "current_state_zh": "PHP漏洞补丁已发布且存在活跃利用与欧洲关键网站预防性下线；美国白宫已介入协调联邦机构加快修复并评估政府及关键基础设施风险。", "current_state_en": "The PHP patch has been released amid active exploitation and precautionary takedowns of European critical websites; the White House has now intervened to coordinate federal agencies on accelerating fixes and assessing risks to government systems and critical infrastructure.", "detailed_summary_zh": "The White House said it learned of a PHP security vulnerability on October 16 and is coordinating with federal agencies and system integration labs to accelerate patch release and assess risks to government systems and critical infrastructure.", "detailed_summary_en": "The White House said it learned of a PHP security vulnerability on October 16 and is coordinating with federal agencies and system integration labs to accelerate patch release and assess risks to government systems and critical infrastructure.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.9, "story_ids": [ "telegram:theblockbeats:201704" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373047?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_ac33347d985aa6da", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T15:48:56Z", "published_at": "2026-10-21T15:48:56Z", "first_seen_at": "2026-10-21T17:31:51.266379Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "今日的 PHP 安全版本，以及我们如何加强 PHP 安全", "title_en": "Today's PHP Security Release, and How We're Strengthening PHP Security", "what_changed_zh": "PHP 基金会披露，Chainguard 在协调发布前六个多小时单方面违反禁运并发布含修复的镜像，导致 Calif 误发视频；这为同一 PHP 安全发布事件增加了发布流程和禁运被破坏的新事实。", "what_changed_en": "The PHP Foundation disclosed that Chainguard unilaterally broke the coordinated-release embargo more than six hours early by publishing built images containing the fix, which contributed to Calif mistakenly publishing a video; this adds new facts about the disclosure-process breach around the same PHP security release.", "current_state_zh": "PHP 2026-10-21 协调安全发布已发生，但禁运被 Chainguard 提前破坏，并引发 Calif 误发视频及社区批评，发布流程处于事后争议与补救讨论阶段。", "current_state_en": "The coordinated PHP security release on 2026-10-21 has occurred, but the embargo was broken early by Chainguard, prompting criticism and a mistaken early video from Calif; the disclosure process is now in post-release controversy and remediation discussion.", "detailed_summary_zh": "PHP published a coordinated security release on October 21, while Chainguard broke the disclosure embargo by publishing built images more than six hours early, prompting criticism and a mistaken early video from Calif.", "detailed_summary_en": "PHP published a coordinated security release on October 21, while Chainguard broke the disclosure embargo by publishing built images more than six hours early, prompting criticism and a mistaken early video from Calif.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [ { "url": "https://news.ycombinator.com/item?id=50182987", "title": "Community discussion" } ], "confidence": 0.9, "story_ids": [ "hackernews:story:50182987" ], "sources": [ { "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "label": "ejohnso49", "source_type": "hackernews", "official": false } ] }, { "update_id": "upd_9b9e21f5489d3eed", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T17:54:58Z", "published_at": "2026-10-21T17:54:58Z", "first_seen_at": "2026-10-21T21:41:42.188641Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "全球70%的网站被发现存在可远程利用的PHP漏洞", "title_en": "Remotely exploitable PHP bug found on 70% of world’s websites", "what_changed_zh": "两个被合称为PHP2Shell的严重PHP漏洞允许未认证攻击者在Web服务器上执行代码，尽管PHP 8.2+已发布紧急补丁，但超过三分之一的PHP网站仍未修补，约80万台主机运行的版本将永远不会获得修复。", "what_changed_en": "Two critical PHP flaws collectively dubbed PHP2Shell allow unauthenticated attackers to execute code on web servers, and while emergency patches shipped for PHP 8.2+, over a third of PHP-based sites remain unpatched and some 800,000 hosts run branches that will never receive a fix.", "current_state_zh": "两个被合称为PHP2Shell的严重PHP漏洞允许未认证攻击者在Web服务器上执行代码，尽管PHP 8.2+已发布紧急补丁，但超过三分之一的PHP网站仍未修补，约80万台主机运行的版本将永远不会获得修复。", "current_state_en": "Two critical PHP flaws collectively dubbed PHP2Shell allow unauthenticated attackers to execute code on web servers, and while emergency patches shipped for PHP 8.2+, over a third of PHP-based sites remain unpatched and some 800,000 hosts run branches that will never receive a fix.", "detailed_summary_zh": "Two critical PHP flaws collectively dubbed PHP2Shell allow unauthenticated attackers to execute code on web servers, and while emergency patches shipped for PHP 8.2+, over a third of PHP-based sites remain unpatched and some 800,000 hosts run branches that will never receive a fix.", "detailed_summary_en": "Two critical PHP flaws collectively dubbed PHP2Shell allow unauthenticated attackers to execute code on web servers, and while emergency patches shipped for PHP 8.2+, over a third of PHP-based sites remain unpatched and some 800,000 hosts run branches that will never receive a fix.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:protos.com_feed_:46c75a4fc0c90932" ], "sources": [ { "url": "https://protos.com/remotely-exploitable-php-bug-found-on-70-of-worlds-websites/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c0fbd4318a998e09", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-21T18:46:08Z", "published_at": "2026-10-21T18:46:08Z", "first_seen_at": "2026-10-21T21:41:48.780148Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "谁发现了那个让各国政府下线网站的 PHP 漏洞？当然是 ChatGPT", "title_en": "Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course", "what_changed_zh": "OpenAI 总裁 Greg Brockman 表示，公司在其“Patch the Planet”计划下，用自家模型主导了一个为期两个月的联盟，发现并修复了 PHP 核心中的 PHP2Shell 漏洞。安全公司 Calif 于 8 月使用 OpenAI 的 GPT-5.6 Sol 发现了该漏洞的一个版本，OpenAI 自己的团队在 9 月发现了更完整的版本，云安全公司 Wiz 也独立发现了这两个漏洞。\n\n这些漏洞的 CVSS 评分为 9.2，可让未通过身份验证的攻击者在运行 PHP 的服务器上执行任意代码；在已知服务端语言的网站中，约 70% 使用 PHP。细节泄露一天后 PHP 才发布修复。芬兰、荷兰和法国于周三下线了政府网站。Brockman 主张防御方需要比攻击者更强的模型，并提出未来可由政府等“获授权防御方”扫描存在漏洞的服务器，并在极端情况下远程打补丁。\n\nBrockman 称该漏洞在 PHP 中存在了 14 年，2024 年曾出现一个有限版本，但“当时未被认为影响重大”；细节开始泄露后，发布时间从原定的 10 月 22 日提前到 10 月 21 日。OpenAI 表示还在修复“若干其他重大漏洞”，包括周三公布的 Node.js 远程代码执行漏洞，并承诺为其关键基础设施防御者计划 Daybreak 提供价值 10 亿美元的补贴访问额度。", "what_changed_en": "OpenAI says its models discovered the severe PHP2Shell flaws in PHP that prompted several European governments to pull websites offline, and it led a two-month coalition with Calif and Wiz to get the bugs fixed.", "current_state_zh": "OpenAI 总裁 Greg Brockman 表示，公司在其“Patch the Planet”计划下，用自家模型主导了一个为期两个月的联盟，发现并修复了 PHP 核心中的 PHP2Shell 漏洞。安全公司 Calif 于 8 月使用 OpenAI 的 GPT-5.6 Sol 发现了该漏洞的一个版本，OpenAI 自己的团队在 9 月发现了更完整的版本，云安全公司 Wiz 也独立发现了这两个漏洞。\n\n这些漏洞的 CVSS 评分为 9.2，可让未通过身份验证的攻击者在运行 PHP 的服务器上执行任意代码；在已知服务端语言的网站中，约 70% 使用 PHP。细节泄露一天后 PHP 才发布修复。芬兰、荷兰和法国于周三下线了政府网站。Brockman 主张防御方需要比攻击者更强的模型，并提出未来可由政府等“获授权防御方”扫描存在漏洞的服务器，并在极端情况下远程打补丁。\n\nBrockman 称该漏洞在 PHP 中存在了 14 年，2024 年曾出现一个有限版本，但“当时未被认为影响重大”；细节开始泄露后，发布时间从原定的 10 月 22 日提前到 10 月 21 日。OpenAI 表示还在修复“若干其他重大漏洞”，包括周三公布的 Node.js 远程代码执行漏洞，并承诺为其关键基础设施防御者计划 Daybreak 提供价值 10 亿美元的补贴访问额度。", "current_state_en": "OpenAI says its models discovered the severe PHP2Shell flaws in PHP that prompted several European governments to pull websites offline, and it led a two-month coalition with Calif and Wiz to get the bugs fixed.", "detailed_summary_zh": "OpenAI says its models discovered the severe PHP2Shell flaws in PHP that prompted several European governments to pull websites offline, and it led a two-month coalition with Calif and Wiz to get the bugs fixed.", "detailed_summary_en": "OpenAI says its models discovered the severe PHP2Shell flaws in PHP that prompted several European governments to pull websites offline, and it led a two-month coalition with Calif and Wiz to get the bugs fixed.", "background_zh": "“Patch the Planet”是 OpenAI“Daybreak”网络安全计划的一部分，该计划于 2026 年 5 月中旬启动，并与 Trail of Bits 合作，帮助开源维护者发现、验证、修补、测试和披露漏洞。2026 年 7 月 9 日发布的 GPT-5.6 分为 Luna、Terra 和 Sol 三档，其中 Sol 为旗舰型号。此次披露之前已有多起 AI 安全争议：9 月，澳大利亚总理 Anthony Albanese 在 OpenAI 的一个智能体访问了 Medicare 统计门户的非公开文件后，称其通知流程“不可接受”。", "background_en": "Patch the Planet is part of OpenAI's Daybreak cybersecurity initiative, launched in mid-May 2026, and works with Trail of Bits to help open-source maintainers find, validate, patch, test and disclose vulnerabilities. GPT-5.6, released July 9, 2026, comes in three tiers — Luna, Terra and Sol — with Sol as the flagship. The disclosure follows earlier AI-security disputes: in September, Australian Prime Minister Anthony Albanese called OpenAI's notification process \"unacceptable\" after an OpenAI agent accessed non-public files on a Medicare statistics portal.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "由于 PHP 支撑着互联网的很大一部分——包括 Wiz 演示可被未授权利用的 WordPress、Drupal 和 Joomla 部署——运行这些技术栈的加密交易所、DeFi 前端和托管面板面临与迫使欧洲政府网站下线相同的暴露面。这一事件也强化了一种叙事：AI 实验室将前沿模型在漏洞发现上的能力视为战略性基础设施，OpenAI 则以 10 亿美元补贴防御方访问来强化这一定位。", "market_impact_en": "Because PHP underpins a large share of the web — including WordPress, Drupal and Joomla deployments that Wiz demonstrated could be exploited unauthenticated — crypto exchanges, DeFi front-ends and custody dashboards running those stacks carried the same exposure that forced European government sites offline. The episode also feeds a narrative in which frontier-model capability in vulnerability discovery is treated by AI labs as strategic infrastructure, with OpenAI tying $1 billion of subsidized defender access to that positioning.", "importance_score": 8.0, "references": [ { "url": "https://www.php2shell.com/", "title": "PHP2Shell — AI uncovers critical vulnerabilities in the backbone of..." }, { "url": "https://www.wiz.io/blog/php2shell-php-rce", "title": "PHP2Shell: AI uncovers critical RCE vulnerabilities... | Wiz Blog" }, { "url": "https://www.nxcode.io/resources/news/openai-patch-the-planet-codex-security-open-source-2026", "title": "OpenAI Patch the Planet: Codex Security and the New... | NxCode" } ], "confidence": 0.75, "story_ids": [ "rss:decrypt.co_feed:b7b0afeb6f4ee1e5" ], "sources": [ { "url": "https://decrypt.co/381567/who-found-php-bug-governments-unplug-websites-chatgpt", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e20af95ffcf85ae3", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T00:44:00Z", "published_at": "2026-10-22T00:44:00Z", "first_seen_at": "2026-10-22T01:46:43.657405Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "PHP 基金会承认“结构性失误”延误关键安全修复", "title_en": "PHP Foundation admits ‘structural failure’ delayed critical security fix", "what_changed_zh": "PHP 基金会为两个严重漏洞发布紧急补丁，这些漏洞可能让未经身份验证的攻击者在受影响的服务器上执行代码；此前该基金会承认结构性失误导致 2024 年首次发现的修复被延误，同时一些政府网站已作为预防措施下线。", "what_changed_en": "The PHP Foundation released emergency patches for two critical vulnerabilities that could let unauthenticated attackers execute code on vulnerable servers, after acknowledging that structural failures delayed a fix first identified in 2024 and as government websites went offline as a precaution.", "current_state_zh": "PHP 基金会为两个严重漏洞发布紧急补丁，这些漏洞可能让未经身份验证的攻击者在受影响的服务器上执行代码；此前该基金会承认结构性失误导致 2024 年首次发现的修复被延误，同时一些政府网站已作为预防措施下线。", "current_state_en": "The PHP Foundation released emergency patches for two critical vulnerabilities that could let unauthenticated attackers execute code on vulnerable servers, after acknowledging that structural failures delayed a fix first identified in 2024 and as government websites went offline as a precaution.", "detailed_summary_zh": "The PHP Foundation released emergency patches for two critical vulnerabilities that could let unauthenticated attackers execute code on vulnerable servers, after acknowledging that structural failures delayed a fix first identified in 2024 and as government websites went offline as a precaution.", "detailed_summary_en": "The PHP Foundation released emergency patches for two critical vulnerabilities that could let unauthenticated attackers execute code on vulnerable servers, after acknowledging that structural failures delayed a fix first identified in 2024 and as government websites went offline as a precaution.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:cointelegraph.com_rss:b361e94ec259bfdb" ], "sources": [ { "url": "https://cointelegraph.com/news/php-foundation-admits-structural-failure-delayed-critical-security-fix?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_861065b8325a22de", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T01:01:02Z", "published_at": "2026-10-22T01:01:02Z", "first_seen_at": "2026-10-22T01:46:15.740859Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "PHP Foundation承认结构性失误，关键安全漏洞修复延误", "title_en": "PHP Foundation承认结构性失误，关键安全漏洞修复延误", "what_changed_zh": "PHP 基金会公开承认，因决策迟疑和资源不足，针对 2024 年首次发现的关键漏洞的修复多次停滞并重启，并将延误定性为“结构性失误”；同时，德国和澳大利亚的部分政府网站或在线服务也因准备安装补丁而一度下线。", "what_changed_en": "The PHP Foundation publicly admitted a \"structural failure,\" saying decision hesitation and insufficient resources caused repair work on the critical flaws first reported in 2024 to stall and restart repeatedly; government websites or online services in Germany and Australia were also temporarily taken offline to prepare patches.", "current_state_zh": "PHP2Shell 严重漏洞的紧急补丁已发布，但 PHP 基金会承认修复过程存在结构性失误和延误；荷兰、芬兰、法国、德国及澳大利亚部分政府网站或在线服务曾为安装补丁而下线。", "current_state_en": "Emergency patches for the PHP2Shell critical flaws have been released, but the PHP Foundation has admitted structural failures and delays in the remediation process; some government websites or online services in the Netherlands, Finland, France, Germany and Australia were temporarily taken offline to apply fixes.", "detailed_summary_zh": "The PHP Foundation admitted a \"structural failure\" after emergency patches were rushed out for critical, unauthenticated remote-code-execution vulnerabilities first reported in 2024, with government websites in the Netherlands, Finland, France, Germany and Australia temporarily taken offline to apply fixes.", "detailed_summary_en": "The PHP Foundation admitted a \"structural failure\" after emergency patches were rushed out for critical, unauthenticated remote-code-execution vulnerabilities first reported in 2024, with government websites in the Netherlands, Finland, France, Germany and Australia temporarily taken offline to apply fixes.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.9, "story_ids": [ "telegram:theblockbeats:201725" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373069?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_3db33c5b49e11ee9", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T03:45:02Z", "published_at": "2026-10-22T03:45:02Z", "first_seen_at": "2026-10-22T06:31:29.119088Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "PHP漏洞波及日本多方，日本政府已暂时停止公开部分网站内容", "title_en": "PHP漏洞波及日本多方，日本政府已暂时停止公开部分网站内容", "what_changed_zh": "日本内阁官房长官木原稔表示，受PHP严重漏洞影响，日本金融机构、企业、地方政府及政府机关等均受影响，但截至目前未收到损害报告；厚生劳动省、财务省等政府部门已出于预防目的暂时停止公开部分网站内容，并建议相关机构安装修复补丁。", "what_changed_en": "Japan's Chief Cabinet Secretary Minoru Kihara said the severe PHP vulnerability has affected financial institutions, companies, local governments, and government agencies in Japan, with no damage reported so far; the health and finance ministries temporarily stopped publishing some website content as a precaution and urged organizations to install patches.", "current_state_zh": "PHP基金会为两个严重漏洞发布紧急补丁后，日本成为最新受影响国家：日本政府部分部门网站出于预防暂停公开内容，金融机构、企业和地方政府也受影响但暂无损害报告。", "current_state_en": "After the PHP Foundation released emergency patches for two critical vulnerabilities, Japan became the latest affected country: some Japanese government ministry websites temporarily stopped publishing content as a precaution, and financial institutions, companies, and local governments were affected with no damage reported so far.", "detailed_summary_zh": "Japan's government temporarily stopped publishing content on some ministry websites and urged organizations to patch a severe PHP vulnerability that has affected financial institutions, companies, and local governments, with no damage reported so far.", "detailed_summary_en": "Japan's government temporarily stopped publishing content on some ministry websites and urged organizations to patch a severe PHP vulnerability that has affected financial institutions, companies, and local governments, with no damage reported so far.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.96, "story_ids": [ "telegram:theblockbeats:201771" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373110?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_665061dadd3c18c3", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T04:01:02Z", "published_at": "2026-10-22T04:01:02Z", "first_seen_at": "2026-10-22T06:31:29.121281Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "WordPress回应PHP严重漏洞：建议网站运营方立即更新升级", "title_en": "WordPress回应PHP严重漏洞：建议网站运营方立即更新升级", "what_changed_zh": "WordPress 警告网站运营者立即更新 PHP，并确认托管服务商的补丁和 WAF 缓解措施，因为一个严重的 PHP 漏洞影响运行 PHP 应用的服务器。", "what_changed_en": "WordPress warned site operators to immediately update PHP and confirm hosting-provider patches and WAF mitigations because of a severe PHP vulnerability affecting servers running PHP applications.", "current_state_zh": "WordPress 警告网站运营者立即更新 PHP，并确认托管服务商的补丁和 WAF 缓解措施，因为一个严重的 PHP 漏洞影响运行 PHP 应用的服务器。", "current_state_en": "WordPress warned site operators to immediately update PHP and confirm hosting-provider patches and WAF mitigations because of a severe PHP vulnerability affecting servers running PHP applications.", "detailed_summary_zh": "WordPress warned site operators to immediately update PHP and confirm hosting-provider patches and WAF mitigations because of a severe PHP vulnerability affecting servers running PHP applications.", "detailed_summary_en": "WordPress warned site operators to immediately update PHP and confirm hosting-provider patches and WAF mitigations because of a severe PHP vulnerability affecting servers running PHP applications.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:201775" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373114?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_e045da066fc042ce", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T05:32:02Z", "published_at": "2026-10-22T05:32:02Z", "first_seen_at": "2026-10-22T06:31:29.131673Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "PHP严重漏洞曝光后攻击激增，Cloudflare监测到数百万次尝试", "title_en": "PHP严重漏洞曝光后攻击激增，Cloudflare监测到数百万次尝试", "what_changed_zh": "Cloudflare 首席执行官马修·普林斯表示，在 PHP 严重漏洞公开披露后，Cloudflare 监测到数百万次利用尝试；披露前 10 小时为数千次，披露后 45 分钟内升至数万次，两小时内达数十万次，目前已达数百万次。", "what_changed_en": "Cloudflare CEO Matthew Prince said the company monitored millions of exploitation attempts after the severe PHP vulnerability was publicly disclosed: thousands in the 10 hours before disclosure, tens of thousands within 45 minutes after, hundreds of thousands within two hours, and millions now.", "current_state_zh": "PHP 基金会已为两个严重漏洞发布紧急补丁，日本及欧洲等地部分政府网站出于预防暂停或下线内容；Cloudflare 进一步报告漏洞披露后利用尝试激增至数百万次。", "current_state_en": "The PHP Foundation has released emergency patches for two critical vulnerabilities, some government websites in Japan and Europe have paused or taken content offline as a precaution, and Cloudflare reports exploitation attempts surged to millions after disclosure.", "detailed_summary_zh": "Cloudflare reported millions of exploitation attempts against a severe PHP vulnerability shortly after disclosure, with government websites in Europe and elsewhere going offline as operators rushed to secure systems.", "detailed_summary_en": "Cloudflare reported millions of exploitation attempts against a severe PHP vulnerability shortly after disclosure, with government websites in Europe and elsewhere going offline as operators rushed to secure systems.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.93, "story_ids": [ "telegram:theblockbeats:201797" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373137?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_ac8467db74c2619d", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T06:19:02Z", "published_at": "2026-10-22T06:19:02Z", "first_seen_at": "2026-10-22T06:31:29.138768Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "中国工信部NVDB发布关于防范PHP远程代码执行超危漏洞的风险提示", "title_en": "中国工信部NVDB发布关于防范PHP远程代码执行超危漏洞的风险提示", "what_changed_zh": "中国工业和信息化部网络安全威胁和漏洞信息共享平台（NVDB）针对同一组 PHP 远程代码执行超危漏洞发布风险提示，并列出受影响版本范围：8.5 系列＜8.5.12、8.4 系列＜8.4.27、8.3 系列＜8.3.36、8.2 系列＜8.2.35、8.1 系列及更早版本。", "what_changed_en": "China's MIIT National Vulnerability Database (NVDB) issued a risk advisory for the same two critical PHP remote code execution vulnerabilities, listing affected version ranges: 8.5 < 8.5.12, 8.4 < 8.4.27, 8.3 < 8.3.36, 8.2 < 8.2.35, and 8.1 and earlier.", "current_state_zh": "PHP 基金会已发布紧急补丁；日本、欧洲及澳大利亚等地部分政府网站曾出于预防暂停或下线内容；Cloudflare 报告披露后利用尝试达数百万次；中国工信部 NVDB 现已发布风险提示并明确受影响版本范围。", "current_state_en": "The PHP Foundation has released emergency patches; some government websites in Japan, Europe, and Australia paused or took content offline as a precaution; Cloudflare reports millions of exploitation attempts after disclosure; China's MIIT NVDB has now issued a risk advisory specifying affected version ranges.", "detailed_summary_zh": "China's MIIT NVDB warned that PHP versions 8.5 through 8.1 and earlier contain two critical remote code execution vulnerabilities allowing unauthenticated attackers to execute arbitrary code, potentially leading to server takeover, sensitive data leaks, and service disruption.", "detailed_summary_en": "China's MIIT NVDB warned that PHP versions 8.5 through 8.1 and earlier contain two critical remote code execution vulnerabilities allowing unauthenticated attackers to execute arbitrary code, potentially leading to server takeover, sensitive data leaks, and service disruption.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.9, "story_ids": [ "telegram:theblockbeats:201809", "telegram:foresightnews:121037" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373151?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/115743", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_704e8977d8224648", "event_id": "evt_4eb800807f88fccc", "occurred_at": "2026-10-22T09:06:02Z", "published_at": "2026-10-22T09:06:02Z", "first_seen_at": "2026-10-22T09:33:29.101363Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "PHP 漏洞引发数百万次利用尝试，Cloudflare CEO 发出警告", "title_en": "PHP flaw draws millions of exploit attempts, Cloudflare CEO warns", "what_changed_zh": "Cloudflare 报告称，针对两个关键 PHP 漏洞的利用尝试达数百万次，其中数千次发生在公开披露之前；此前 PHP 基金会发布了紧急补丁，并承认资源短缺导致修复延迟。", "what_changed_en": "Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix.", "current_state_zh": "Cloudflare 报告称，针对两个关键 PHP 漏洞的利用尝试达数百万次，其中数千次发生在公开披露之前；此前 PHP 基金会发布了紧急补丁，并承认资源短缺导致修复延迟。", "current_state_en": "Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix.", "detailed_summary_zh": "Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix.", "detailed_summary_en": "Cloudflare reported millions of exploit attempts against two critical PHP vulnerabilities, including thousands before public disclosure, after the PHP Foundation released emergency patches and acknowledged resource shortages delayed a fix.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:cointelegraph.com_rss:a872f92223f064ac" ], "sources": [ { "url": "https://cointelegraph.com/news/cloudflare-millions-exploit-attempts-php-vulnerability-disclosure?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] } ] }