欢迎来到Kernel Panic，由Lily Hay Newman 和 Matt Burgess 来自隐私和数字安全新世界的每周通讯。 每周在收件箱里收到这份通讯请在这里报名
随着安全小组和网络管理员本周纷纷抢修新公开的PHPbug，犯罪黑客迅速试图利用野外的缺陷。 根据Cloudflare的分析，数百万的剥削企图在公布脆弱性后的几小时内受到打击——令人惊讶的是，由于广泛获得AI工具，使攻击者更容易迅速利用缺陷。
至今为止，PHP Foundation 称并未看到任何成功利用bug，然而，也许人工智能在本周的混乱中最有趣的作用是，先进的模型如何帮助研究人员发现对脆弱性的实际利用，这些脆弱性至少是多年来所了解的。 换句话说，大赦国际帮助将历史脆弱性转变为当前的危机。
因此，我们是否都即将被数十年来不断出现的关键弱点浪潮所困扰？
保安公司Calif的研究人员首先在8月初查明了PHP2Shell的弱点并创造了利用——部分使用前沿AI工具作为OpenAI的Patch the Planet方案的一部分，但也利用了人类专家对PHP、其动态及其弱点的了解。 一些根本问题在2024年被确定，但被认为过于复杂，无法在当时加以利用。 在卡利夫发现后，OpenAI和Google所属的安保公司Wiz的研究人员使用AI工具独立发现了PHP2Shell缺陷。
" PHP小组多年来已经知道这种脆弱性，但由于攻击者——至少不是人类——无法利用这种脆弱性，Wiz的安全研究员称 Sagi Tzadik没有加以解决。
没有软件是完美的。 甚至最关键、最基本的数字工具也不可避免地存在缺陷，但AI模型不断扩展的能力使得分析和潜在利用脆弱性的速度更快。 这给资源不足的IT团队，开发人员，以及管理者带来更大的压力来跟上。 Microsoft的安保更新仅本月就有1 453个安全漏洞。 与此同时，美国银行最近聘请了1000名顾问来弥补Anthropic神话中发现的缺陷。 然而，安全研究者强调，大赦国际最终并没有做任何新的工作，而是放大了脆弱性发现和协调披露的现有动态。
称 Jake Williams是猎人战略研发副总裁，“但我认为这种低调的水果只有这么多。 也没什么比PHP更好的了。 大部分其他工具并没有通过设计接触互联网。
研究者也指出，即使有前沿模型，人工智能协助黑客化的大多数例子也涉及人的专门知识。 最早发现PHP缺陷的卡利夫研究员Ryan Austin本周写道，“没有任何模型能够简单地用简单的提示揭开`所有bugs'。 至少暂时如此。”
简言之，安全工程师兼研究员尼尔斯·普罗沃斯·称，每个人都可以拨回他们的怪胎，至少可以拨回一点。 称担心AI发现大量历史错误，“现在，人们已经与大赦国际一起找了一年多，它需要一个高技能的团队来找到这个团队。 我想，我们将看看我是否完全错了，但我怀疑。”
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.
As security teams and web admins scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. Millions of exploitation attempts hit within hours of the vulnerabilities being published, according to analysis from Cloudflare—unsurprising given broad access to AI tools that can make it easier for attackers to quickly exploit flaws.
So far, the nightmare scenario of mass victim takeovers and breaches hasn’t come to pass. The PHP Foundation says it hasn’t seen any successful exploitation of the bugs, collectively dubbed PHP2Shell, and many publicly circulating potential exploits appear to be ineffective. However, perhaps the most interesting role of AI amid the chaos this week is how advanced models helped researchers uncover practical exploitations for the vulnerabilities, which were known about, at least in part, for years. In other words, AI helped turn historic vulnerability into a current crisis.
So are we all about to be walloped by a wave of critical vulnerabilities that have been kicking around for decades?
Researchers at security company Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August—partially using frontier AI tools as part of OpenAI’s Patch the Planet program, but also using expert human knowledge of PHP, its dynamics, and its weaknesses. Some of the underlying issues were identified in 2024 but were deemed too complex to exploit at the time. Following Calif’s discovery, researchers at OpenAI and the Google-owned security firm Wiz independently discovered PHP2Shell flaws using AI tools.
“The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed,” says Sagi Tzadik, a security researcher at Wiz.
No software is perfect. There are inevitably flaws in even the most critical, foundational digital tools, but the expanding capabilities of AI models have made it faster to analyze and potentially exploit vulnerabilities. This puts even more pressure on under-resourced IT teams, developers, and admins to keep up. Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone. Meanwhile, Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos. Security researchers emphasize, though, that AI is ultimately not doing anything new, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure.
“We'll definitely see more of these long-life bugs that are in every version of the software for the last decade or whatever,” says Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker. “But I think there’s only so much of this low-hanging fruit. There isn’t much else that has the specific reach of PHP. It’s a pretty wild attack surface—most other tools aren’t exposed to the internet by design.”
Researchers note, too, that even with frontier models, most examples of sophisticated AI-aided hacking also involve human expertise. As Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote this week, “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.”
In short, security engineer and researcher Niels Provos says, everyone can dial back their freak-outs, at least a bit. “To be honest, I am not really worried,” he says, about AI finding an overwhelming number of historic bugs that are newly exploitable—or new vulnerabilities that couldn’t have been practically exploited without AI. “People have now been looking with AI for over a year, and it required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it.”
Auto-fetched and translated by AI Atlas. All rights belong to the original author.