美国国家安全局（NSA）就 PHP 两个关键漏洞发布修补建议，要求组织修补被命名为 PHP2Shell 的漏洞，或将未修补服务器下线。这两个漏洞均位于 PHP 核心，CVSS 评分均为 9.2，影响版本可追溯至 5.4；PHP 已于 10 月 21 日发布 8.5.12、8.4.27、8.3.36 和 8.2.35 修复版本。
同一件事，精选收录的是《AI 安全公司 Calif 用 GPT-5.6 Sol 发现 PHP 严重漏洞，影响约 70% 网站》
National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language
Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol
In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online.
The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline.
Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top.
When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust.
On Apache’s mod_php, a demonstrated exploit triggers the corruption before any application code runs, so logins and app-level checks cannot block it.
Cloudflare saw attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21.
VirusTotal counts about 5.1M IP addresses running PHP, and about 758K that show a version run end-of-life branches with no patched release.
That long tail will set how long PHP2Shell stays exploitable, since each owner must upgrade, find a backport or take the server offline.
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch. Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.” > PHP rushed out fixes as it could let attackers without accounts take over web servers. > Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4. > When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack. > Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack. > Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months. > A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.在 X 查看被引用的帖子
来源：Rohan Paul · x.com