PHP 8.x 紧急安全更新：修复两个远程代码执行漏洞
Today's PHP Security Release, and How We're Strengthening PHP Security
Today's PHP Security Release, and How We're Strengthening PHP Security
今天的 PHP 安全发布，以及我们如何加强 PHP 安全性
If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process.
如果您在运行任何基于 PHP 的应用程序，升级至关重要——今天的更新（涵盖整个 PHP 8.x 系列）解决了两个远程代码执行漏洞，由于协调披露流程中的泄露，相关利用代码自昨晚以来一直在流传。
This post from the PHP Foundation explain what went so wrong:
PHP 基金会发布的这篇文章解释了出错的原因：
On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC [...]
10 月 20 日星期二，大约 UTC 时间 15:00，两个 CVE ID 开始在在线论坛和社交媒体上流传。它们附带了错误的发布时间以及错误的 CVSS 评分 10.0（实际评分为 9.2）。没有技术细节泄露。作为回应，PHP 项目提前发布了预公告，并于 UTC 时间 19:30 公布。它还将发布日期从 10 月 22 日 UTC 时间 14:00 提前至 10 月 21 日 UTC 时间 14:00 [...]
As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.
由于约 UTC 时间 20:00 的泄露和预公告，曾报告这些问题的安全公司之一的 Calif 错误地发布了一段视频。该视频展示了他们的概念验证（PoC）针对多个目标的成功情况，并透露了一些额外的、尽管有限的漏洞细节。被删除的视频副本随后很快在社交媒体上开始流传。这段视频促进了各种 PoC（利用概念验证）的开发加速，进而导致其在 10 月 21 日的传播增加。
This article from the team that discovered the original vulnerability includes a more detailed timeline of the original intended responsible disclosure:
发现原始漏洞的团队撰写的这篇文章包含了关于原定负责任披露的详细时间线：
- August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
- August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
- August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
- August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
- September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
- October 21, 2026: Patched PHP releases become available.
- October 21, 2026: Public disclosure.
- 2026 年 8 月 19 日：Wiz Research 使用 Wiz Atlas、Gemini 4 Argon 和 GPT-5.6 Sol 发现了第一个 PHP 漏洞。
- 2026 年 8 月 20 日：确认了对 Drupal 的未授权远程代码执行（RCE）。
- 2026 年 8 月 21 日：确认了对 WordPress 的未授权远程代码执行（RCE）。
- 2026 年 8 月 24 日：Wiz Research 向 PHP 安全团队报告了这些漏洞。
- 2026 年 9 月 21 日：PHP 确认收到报告并开始开发协同修复方案。
- 2026 年 10 月 21 日：已修补的 PHP 版本发布可用。
- 2026 年 10 月 21 日：公开披露。
Via Hacker News
来源：Hacker News
Tags: open-source, php, security, ai, ai-security-research
标签：开源, php, 安全, ai, ai-security-research
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力