PHP高危漏洞影响70%网站多国政府被迫下线
Remotely exploitable PHP bug found on 70% of world’s websites
A bug that allows hackers to remotely execute code has been discovered in PHP, the language that powers 70% of the world’s websites.
在支撑全球70%网站运行的PHP语言中，发现了一个允许黑客远程执行代码的漏洞。
PHP shipped emergency fixes today for two of the most critical flaws, but over one-third of the web remains unpatched as of publication time.
PHP今天发布了针对两个最严重缺陷的紧急修复补丁，但截至发稿时，仍有超过三分之一的网站未打补丁。
The language, used to program website backends, runs on servers, not in the browser, and sends its resulting HTML or other dynamic data to the browser.
这种用于编写网站后端的语言运行在服务器上，而非浏览器中，并将生成的HTML或其他动态数据发送到浏览器。
Official fixed releases only cover PHP 8.2 and newer, leaving over one-third of PHP websites without a patch.
官方发布的修复版本仅涵盖PHP 8.2及更高版本，导致超过三分之一的PHP网站没有补丁可用。
Mid-day, backports were starting to roll out across older versions 7.4-8.1. Unfortunately, according to one estimate, more than 800,000 internet hosts serving content to millions of websites run a branch of PHP so old “that will get no fix” at all.
中午时分，向后移植的补丁开始向7.4至8.1等旧版本推送。不幸的是，据估计，有超过80万个互联网主机为数百万个网站提供服务，它们运行的PHP分支过于陈旧，“根本不会获得任何修复”。
The two flaws, CVE-2026-109618 and CVE-2026-109619, are collectively PHP2Shell.
这两个漏洞（CVE-2026-109618和CVE-2026-109619）统称为PHP2Shell。
PHP2Shell lets an unauthenticated attacker run code on a web server and serve buggy outputs to a user’s browser.
PHP2Shell允许未经身份验证的攻击者在Web服务器上执行代码，并向用户的浏览器提供存在缺陷的输出。
Hackers’ exploits can occur even before a website’s own code executes.
黑客的攻击甚至可以在网站自身代码执行之前发生。
Abandoned DeFi websites used to host crypto wallet drainers
被遗弃的DeFi网站曾用于托管加密钱包盗取程序
Read more: Whitehat hacker accuses Injective of ghosting after $500M bug disclosure
阅读更多：白帽黑客指控Injective在披露5亿美元漏洞后将其晾在一边
AI hacked PHP, found a bug affecting most websites
AI入侵PHP，发现影响大多数网站的漏洞
A security researcher using OpenAI’s GPT-5.6 Sol model discovered the bug during an August audit funded by OpenAI.
一名使用OpenAI GPT-5.6 Sol模型的安全研究人员在OpenAI资助的8月审计过程中发现了该漏洞。
That researcher was part of Calif, a partner in OpenAI’s Patch the Planet program, which pairs frontier models with expert human cybersecurity review.
该研究人员是Calif的成员，而Calif是OpenAI“修补地球”（Patch the Planet）项目的合作伙伴，该项目将前沿模型与专家级人工网络安全审查相结合。
The bug class had been flagged decades earlier yet dismissed as too hard to exploit, Calif’s CEO Thai Duong told the Wall Street Journal.
Calif的首席执行官Thai Duong告诉《华尔街日报》，这类漏洞早在几十年前就被标记过，但当时被认为太难利用而被忽视。
However, AI hackers have now figured out how to seize control of a server’s memory within a few dozen requests.
然而，AI黑客现在已经掌握了如何在几十次请求内控制服务器内存的方法。
Wiz, a division of Google Cloud, confirmed the flaws independently. Wiz’s co-founder called PHP2Shell “the most severe AI vulnerability that was ever found,” and one humans would probably never have found.
Google Cloud旗下的Wiz独立确认了这些漏洞。Wiz的联合创始人称PHP2Shell是“有史以来发现的最严重的AI漏洞”，而且人类可能永远无法发现它。
Cloudflare reacts as PHP alarms ring around the world
Cloudflare对全球响起的PHP警报做出反应
Cloudflare’s CTO Dane Knecht reported live exploit vectors for every customer, including free plans.
Cloudflare的首席技术官Dane Knecht实时报告了每位客户（包括免费计划用户）面临的漏洞利用向量。
The website cacheing giant implemented a stopgap emergency measure overnight before announcing more patches a few hours later.
这家网站缓存巨头在宣布几小时后发布更多补丁之前，连夜实施了临时应急措施。
*FINLAND SHUTS STATE INTERNET SERVICES OVER PHP FLAWS
*芬兰因PHP漏洞关闭国家互联网服务
*NETHERLANDS CYBERSECURITY AGENCY TAKES WEBSITE OFFLINE OVER PHP FLAWS
*荷兰网络安全机构因PHP漏洞使网站下线
*FRANCE TEMPORARILY TAKES PREFECTURE WEBSITES OFFLINE PENDING PHP FIX: MINISTRY https://t.co/mi9GbPXmOK
*法国暂时使省府网站下线，等待PHP修复：财政部 https://t.co/mi9GbPXmOK
— *Walter Bloomberg (@DeItaone) October 21, 2026
— *Walter Bloomberg (@DeItaone) 2026年10月21日
The PHP bug had worldwide impact. Finland’s state IT center shut several government web services as a precaution.
该 PHP 漏洞产生了全球性影响。芬兰国家 IT 中心出于预防目的关闭了若干政府网络服务。
Meanwhile, in the Netherlands, NotuBiz’s council information sites for local governments went offline, with MijnOverheid and the Dutch parliament’s site following.
与此同时，在荷兰，NotuBiz 为地方政府提供的 council 信息网站下线，MijnOverheid 和荷兰议会网站随后也受到影响。
Patched versions of PHP include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, 27% of PHP sites still run PHP 7, and 7.7% run PHP 5, which remain unpatched.
已打补丁的 PHP 版本包括 8.5.12、8.4.27、8.3.36 和 8.2.35。然而，仍有 27% 的 PHP 站点运行着未修复的 PHP 7，另有 7.7% 的站点运行着未修复的 PHP 5。
GoDaddy urged customers to upgrade.
GoDaddy 敦促客户进行升级。
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTubechannel.
有线索？请通过 Protos Leaks 向我们发送加密邮件。如需获取更多深度资讯与调查报道，请关注我们在 X、Bluesky 和 Google News 上的账号，或订阅我们的 YouTube 频道。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力