AI发现PHP严重漏洞致大规模宕机，Wiz称效率提升显著
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs a…
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
使用 GPT-5.6 Sol 的研究人员在 PHP 中发现了一个极其严重的安全漏洞。PHP 运行着约 70% 的网站，在运营商匆忙打补丁的过程中，导致多个主要网站瘫痪。
Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”
发现该漏洞的加州 AI 安全公司 Calif 在一份声明中表示，如果这些漏洞不能迅速修复，将使全球 70% 的网站面临风险，并称之为“人工智能发现的，甚至可能是软件历史上最严重的漏洞。”
> PHP rushed out fixes as it could let attackers without accounts take over web servers.
> PHP 紧急发布了修复程序，因为该漏洞可能让无账户的攻击者接管 Web 服务器。
> Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4.
> 这两个漏洞在 CVSS 严重程度评分中均获得 9.2 分，影响版本低至 PHP 5.4。
> When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack.
> 当请求在不恰当的时机触及 PHP 的内存上限时，PHP 会释放内存但保留指向它的指针，后续对该工作进程的请求可以劫持这些指针。
> Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack.
> 审计员在 2024 年发现了这一弱点，但修复工作停滞了数月，部分原因是此前无人展示过实际攻击案例。
> Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months.
> 现由 Google 拥有的云安全公司 Wiz 表示，这些模型使一名研究人员能在一个月内完成过去顶尖团队需要数月才能完成的工作。
> A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.
> CVE 编号的泄露迫使 PHP 提前一天发布补丁，而 Cloudflare 现在报告了早期的攻击尝试。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力