作者复盘 PHP 两个 CVSS 满分起步的远程代码执行漏洞（CVE-2026-109618、CVE-2026-109619，合称 PHP2Shell）从提前…
业务目标：69.3%的网站跑在PHP上，两个洞藏了二十年
W3Techs 统计：69.3% 的 Web 站点以 PHP 为后端。这两个洞藏在 5.4 时代引入的请求处理代码里，二十年无人问津。PHP 基金会在复盘里公开求助，Debian 的 PHP 打包维护者月赞助不到 700 美元。发现速度提了十倍，拆弹的人没多一个。当 AI 把全世界的雷都翻出来，有足够多的人去拆吗？
漏洞技术原理：multipart POST触发内存破坏，无需认证即可RCE
攻击者发一条特制 multipart POST 请求，PHP 解析器在读文件上传进度字段时越界写堆内存，触发点位于应用代码执行之前，无需登录、无需构造应用层 payload。腾讯云安全通告原文写得很直接：「可导致未经身份验证的远程攻击者通过发送特制的 multipart POST 请求，触发内存破坏并最终实现远程代码执行」（通告链接）。
发现方式值得单独说。研究员让 GPT-5.6 Sol 把第一个洞的错误模式写成一份 SKILL.md，Agent 拿这份指引沿同一条线索扫全库，在文件上传进度的记录逻辑里找到了第二个洞。找到的不再是一个点，而是一整类问题。人挖到一个就停了，方法论可以自动产出下一个。
影响面：Apache mod_php默认配置最危险，WordPress和Drupal全中
全部 SAPI 在风险内：PHP-FPM、Apache mod_php、php-cgi、FrankenPHP、LiteSpeed。mod_php 与 Apache 共享进程地址空间，内存破坏直接打到 Web 服务本体，所以默认配置最危险。WordPress、Drupal、Laravel，只要底层是 PHP，改插件没用，只能升 PHP 二进制。修复版本 8.5.12、8.4.27、8.3.36、8.2.35。还在跑 8.1 及更早停止支持版本的，CISA 建议只有四个字：先下机器。
PHP2Shell攻击路径与AI发现流程
二十年没人看的代码，一个模型两天全翻出来
方案A（传统人工审计）：为什么二十年没人发现
人工审计的覆盖瓶颈：代码量与经验不可复制
PHP 核心代码库自 2004 年起经历多轮重构，multipart POST 解析路径上的边界条件组合呈指数级增长。GPT-5.6 Sol 两天定位到文件上传进度模块中的内存破坏点，随后将错误模式写成 SKILL.md 审计指引，Agent 拿着同一份指引继续扫描，找到第二个洞。
一个顶尖研究员对 C 内存模型和 SAPI 接口的理解，过去难以复制给第二个人。现在它是一份文件，交给几千个 Agent 实例并行跑。代码量没变，读代码的人变了。
PHP基金会的维护困境：Debian打包者月赞助不到700美元
69.3% 的网站跑在 PHP 上，Debian 打包者月赞助不到 700 美元。修复拖两个月，不是技术解不了，是人力管道里没人排队。
传统审计管道断裂点
当 AI 把全世界的雷都翻出来，拆雷的人没多一个。
方案B（AI Agent审计）：两天挖穿核心，SKILL.md让发现可复制
从碰到一个点到扫出一整类问题的机制
方案A的瓶颈在于经验不可复制。AI 把这条管道接上了，但接法决定效率。
PHP2Shell 的发现过程里有个关键动作。研究者用 GPT-5.6 Sol 挖出 CVE-2026-109618 之后没有收工，他们让模型把刚发现的错误模式写成一份 SKILL.md，即一份可反复调用的审计指引，然后让 Agent 沿同样线索在整个代码库里继续扫。结果是在负责记录文件上传进度的那段代码里，找到了 CVE-2026-109619。
这一步改变了发现的拓扑结构。人挖到一个洞，经验留在脑子里，下一个人从零推理；AI 挖到一个洞，经验被序列化成一份文件，可以同时交给成百上千个 Agent 并行去跑。
从单点到类扫的审计管线
Chrome 156 的 353 个漏洞：AI 报告已成主力
这不是孤例。10 月 20 日 Google 发布 Chrome 156 正式版，单版本修复 353 个安全漏洞；一年前的 Chrome 141 和 142，这个数字分别是 21 和 26。一年时间，单版本修复量涨了十倍以上（数据来源：极客公园对 Chrome 安全公告的统计）。
报告人的名单也变了。Chrome 156 里最高等级的 6 个「严重」漏洞，4 个由 Anthropic 研究员 Xinyang Ge 提交，其中 1 个明确标注「由 Claude 协助」；另 1 个来自 OpenAI 的 Codex Security。AI 公司的名字，已经成批出现在全球用户最多的浏览器的安全公告里。
OpenAI 在 PHP2Shell 公开当天给了一句判断，原话是：未来几个月，类似的发现会急剧增加。发现端的机器速度已经跑起来了，但拆弹的人还是那批人。当 AI 把全世界的雷都翻出来的时候，我们有足够多的人去拆吗？这个缺口是下两段要处理的事。
方案C（混合修复管道）：为什么修复要两个月
发现到修复之间的架构断层：补丁、回移植、生态同步的时间线
AI 把发现压缩到两天，修复管道仍要走完完整的工程周期。PHP2Shell 的补丁最终落在四个分支：8.5.12、8.4.27、8.3.36、8.2.35。每个分支独立验证 multipart 解析路径的内存破坏是否被堵死，跑完整回归测试确认没有引入新的解析异常。不是一个 diff 能交差的事，是四套测试套件乘以三种运行时（mod_php、PHP-FPM、php-cgi）的排列组合，再叠加 FrankenPHP 和 LiteSpeed 的私有集成层。
断层不在打补丁这一步，在补丁之后的分发。Apache mod_php 下解析器直接嵌入 Apache 进程，修复意味着重启整个 web 服务，生产环境的重启窗口本身就要排期；PHP-FPM 可以热重载 worker 进程，但 FrankenPHP 用 Rust 写的 runtime 有自己的编译链路。WordPress、Drupal 的插件生态不会因一次 8.3.36 发布自动重编，各托管商和云平台的 CI 流水线得逐个触发。生态同步的时间成本经常超过补丁开发本身。
而维护这条管道的核心人力，Debian 打包者月赞助不到 700 美元。撑的是全球 69.3% 网站的底层。EOL 版本（8.1 及以下）不在四个修复分支里，CISA 的建议没有第二种选项：拉不到支持版本，直接下线隔离。
PHP2Shell 修复管道与各环节耗时
在野利用先于补丁四天的窗口期怎么补
补丁上线前四天，PoC 已在灰市流通。这里有一个信息差值得注意：CISA 在公告文本里写「截至发布时未观察到实际攻击」，而 CERT-EU 同步声明中明确标注 PoC 已经流传。两个机构的监测口径不同，但指向同一个事实：攻击者不需要等官方公告，他们只需要等 PoC 在暗网论坛完成第一次转手。
Cloudflare CEO 给了一个数据锚点：正式披露前 10 小时，全网已记录数千次利用尝试；公告发出后 45 分钟，数字跳到数万；两小时突破数十万。曲线是指数型的，意味着每多等一小时，新增的失陷面是前一小时的好几倍。
这四天防守方能做什么？WAF 规则可以拦截畸形 multipart 特征码，但 php.net 原文是「没有完整的缓解方式，升级是唯一安全的选择」。WAF 挡的是流量特征，挡不住攻击者换一层编码再打。Cloudflare 网络层规则能多争取几小时应急窗口，替代不了底层解析器修复。对跑在 EOL 版本上的系统，CISA 的建议只有一条：把机器从网络上拔下来。
多国政府的应对层级其实反映了不同的资源约束。芬兰政府直接下线了面向公众的网站；日本首相高市早苗公开表态「来不及修就暂时关站也是降低风险的有效措施」；NSA 向所有使用 PHP 的联邦机构推送了更新指令；加拿大、英国、新加坡、澳大利亚和欧盟委员会同步发警。动作不同，逻辑相同：补丁没到之前，把暴露面缩到零。
从经验看，四天窗口不是 PHP 的个案。只要发现侧的速度持续快于部署侧，每个「2 天发现 + N 天修复」周期里的差值就是天然在野利用窗口期。缩短 N 有两条可执行路径：一是把补丁分发做进 CI/CD 流水线，让部署侧跟发现侧同速，托管商和云平台在公告发布的同时自动触发升级；二是对 EOL 版本建立强制隔离机制，让「暂时跑着」不再等于「永远跑着」。没有这两条，下一个 PHP2Shell 的窗口期只会更长，因为发现侧的速度还在涨。
选型决策：你的 PHP 资产该走哪条修复路径
决策表：版本 × 是否在维护期 × 能否热更新
php.net 公告里只留了一句判断：「没有完整的缓解方式，升级是唯一安全的选择。」但升级的前提是你清楚自己跑在哪个版本、哪种运行时上。官方修复版只有 8.5.12、8.4.27、8.3.36、8.2.35 四支，8.1 及以下不在回移植范围内。
当下七十二小时该做的三件事
第一，资产清点。对所有生产环境跑 php -v，云厂商控制台（AWS ECS、阿里云函数计算、GCP Cloud Run）都有批量拉取 PHP 版本号的接口。漏掉一台未纳管的虚机，整条补丁链就断在那里。
第二，不能升的先下。CISA 公告措辞很直白：跑在 8.1 及以下、短期内完不成大版本升级的系统，断网。Finland、荷兰、日本已经在做了。WAF 规则能买四到六小时缓冲，但 CERT-EU 确认 PoC 已在流传，缓冲不是方案。
第三，盯日志。在访问日志里 grep 异常 multipart POST 请求，重点看绕过前端框架直接打到 PHP 内核 handler 的路径。如果 404 后面紧跟 200，说明有东西已经进去了。
架构全景：一条图讲清发现、修复、验证的完整链路
Mermaid 流程图与关键卡点
把前面四段串成一条管道，真正卡时间的只有两处：发现到报告（这次是零，AI 直接吐 PoC），以及补丁回移植加生态同步（四个并行分支，下游 WordPress 和 Drupal 维护者还得各自发适配更新）。
PHP2Shell 攻防全链路
两个数字把瓶颈说完了：发现端两天，修复端两个月。AI 把前半段压到了极限，后半段卡在一个月赞助不到七百美元的 Debian 打包者和四个分支的回移植工时上。你买的旗舰款，瞬间变成平替套餐。
参考文献
- 腾讯云安全通告（CVE-2026-109618 / [REDACTED]）：cloud.tencent.com/announce/de…
- 36氪报道：www.36kr.com/p/403656693…
- 博客园技术拆解：www.cnblogs.com/xiaobaiysf/…
- 经济参考报：jjckb.xinhuanet.com/20261022/f2…
- 腾讯云开发者社区：cloud.tencent.com/developer/a…
延伸入口
- 原文归档：tobemagic.github.io/ai-magician…
- 公众号：计算机魔术师
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Author's redisposal PHP two CVSS full-segregation remote code execution loopholes (CVE-2026-109618, CVE-2026-109619, PHP2Shell) from early...
Operational objective: 69.3 per cent of websites run on PHP, two hidden for 20 years
W3Techs Statistics: 69.3% of Web sites have PHP backend. These two holes were hidden in the request processing code introduced by the 5.4 era, which has been unobserved for 20 years. The PHP Foundation has publicly sought help in the flash drive, and Debian’s PHP pack maintainer has sponsored less than $700 per month. The speed was ten times higher, and not one more was found. When AI pulls the world's thunder out, is there enough people to tear it down?
Hole technical rationale: multipart POST trigger memory damage, RCE without authentication
The assailant sent a specially designed multipart POST request that the PHP solver cross-written memory at field when reading the file uploading progress. The trigger point was before the application code was executed without having to login or construct the application layer payload. The original text of the Tencent cloud security announcement is very direct: "may lead to a remote attacker without authentication to trigger memory damage and eventually achieve remote code execution by sending a specially designed multipart POST request."
It's worth saying alone. The researcher asked GPT-5.6 Sol to write the wrong pattern of the first hole into a SKILL.md, Agent, to sweep the library with this guidance along the same thread and find the second hole in the log logic of uploading the progress of the file. What was found was no longer a point, but an entire category of problems. People dig one and stop, and methodology can automatically produce the next.
Impact side: Apache mod php default configuration most dangerous, WordPress and Drupal all
All SAPIs are at risk: PHP-FPM, Apache mod php, php-cgi, FrankenPHP, LiteSpeed. Mod php shares process address space with Apache, memory damage hits the Web service owner directly, so the default configuration is the most dangerous. WordPress, Drupal, Laravel, as long as the bottom is PHP, the plugin is useless and can only be PHP binary. Refurbishment versions 8.5.12, 8.4.27, 8.3.36, 8.2.35. Still running 8.1 and earlier to stop supporting the version, CISA suggested only four words: first down the machine.
PHP2Shell attack path and AI discovery process
The code hasn't been looked at in 20 years.
Option A (traditional manual auditing): why no one has found out for 20 years
Overriding bottlenecks of manual audits: code volumes and experience are not replicable
The PHP Core Code Library has undergone multi-wheel re-engineering since 2004, and the combination of boundary conditions on the multipart POST resolution path has increased exponentially. GPT-5.6 Sol locates the memory damage points in the file upload progress module for two days, and then puts the error pattern into SKILL.md Audit Guidance, where Agent continues to scan with the same guidance and finds the second hole.
A top researcher's understanding of the C memory model and SAPI interface was hard to copy to a second person in the past. Now it's a document that gives thousands of Agent examples running in parallel. The code didn't change. The code reader changed.
PHP maintenance dilemma: Debian packers sponsored less than $700 per month
69.3 per cent of websites run on PHPs, and Debian packers sponsor less than $700 per month. The repairs were delayed for two months, not by technicalities, but by the fact that there was no line in the manual pipeline.
Traditional audit pipeline fracture points
When AI turned the world's thunder out, there wasn't one more mine breaker.
Option B (AI Audit): Two days to dig through the core, SKILL.md to find replicable
From a point to an entire set of problems.
The bottleneck in Model A is that experience cannot be replicated. AI put the pipe on, but it decided efficiency.
PHP2Shell has a key move in the discovery process. Researchers used GPT-5.6 Sol to dig up CVE-2026-109618 and then did not close, and they made the model write the newly discovered error pattern into a SKILL.md, an audit guide that can be called repeatedly, and then asked Agent to follow the same clue and continue to sweep the entire code. As a result, CVE-2026-109619 was found in the code that records the uploading of documents.
This has changed the structure of the sprawl found. People dig a hole, experience stays in their head, and the next person goes from zero to zero; AI digs a hole, experience is sequenced into a document and can be given to hundreds of Agents running in parallel.
Audit line from single point to class sweep
353 loopholes in Chrome 156: AI reports are dominant
It's not an isolated case. On 20 October, Google publish Chrome 156, a single version, repaired 353 security loopholes; a year ago, Chrome 141 and 142, figures 21 and 26, respectively. Over the course of a year, the number of single-version repairs has increased more than tenfold (data source: statistics on the Crome Safety Bulletin in Polar Park).
The list of reporting persons has also changed. Six of the highest-level "serious" loopholes in the Chrome 156, four by Anthropic Researcher Xinyang Ge, one of which is clearly marked "with the assistance of Claude"; and one from Open AI, Codex Security. The name of AI has appeared in bulk in the security bulletins of the most user browser worldwide.
Open AI gave a judgement on the day PHP2Shell was released, saying that similar discoveries would increase dramatically in the coming months. The engine speed of the end was found to be running, but the bomber was still the same group. When AI turns the world's thunder out, do we have enough people to tear it down? This gap is addressed in the next two paragraphs.
Option C (Mixed repair pipeline): Why two months to repair
Found structural faults between repairs: patches, back transplants, time for ecosynchronization Line
AI compressed the discovery to two days, and the repair of the pipe still required a complete construction cycle. PHP2Shell ' s patches eventually fell on four branches: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Each branch independently verifies whether the memory damage of the multipart resolution path has been blocked and the full runback test confirms that no new resolution anomalies have been introduced. It's not a diff thing, it's four test packages multiplied by a combination of three running hours (mod php, PHP-FPM, php-cgi), superseding FrankenPHP and LiteSpeed's private integration layer.
The fault is not a patch, but is distributed after the patch. Apache mod php solver is directly embedded in the Apache process, repairing means restarting the entire web service, and the restart window in the production environment is itself scheduled; PHP-FPM can heat up the worker process, but FrankenPHP has its own compilation link written by Rust. WordPress, Drupal's plugin ecology will not be triggered by an automatic re-engineering of 8.3.36 publish, with the various custodians and the CI flow lines of the cloud platform. Ecosynchronous time costs often exceed patch development itself.
And the core manpower to maintain the pipeline, Debian Packers don't sponsor less than $700 a month. The bottom of the global 69.3% website. The EOL version (8.1 et seq.) is not in the four repair branches, and the CISA proposal does not have a second option: the support version is not available and is directly offline.
PHP2Shell Repair of pipes and links time-consuming
How do you fix it with a four-day window before patching?
Four days before patches went online, PoC was in circulation in the grey market. Here is a discrepancy: CISA wrote "no actual attack observed as of publish" in the text of the bulletin, and the CPT-EU sync statement clearly indicates that PoC has been circulated. The two bodies had different monitoring calibres, but pointed to the same fact: the attackers did not have to wait for official announcements and they simply had to wait for the PoC to complete the first transfer at the Dark Net Forum.
Cloudflare CEO gave a data anchor: 10 hours before the official disclosure, thousands of attempts were recorded on the Internet; 45 minutes after the announcement, the number jumped to tens of thousands; and two hours exceeded hundreds of thousands. The curve is indexed, meaning that every additional hour, the new fall is several times greater than the previous hour.
What can the defense do these four days? WAF rules can intercept deformity multipart character codes, but php.net is "without complete mitigation, upgrading is the only safe option". The WAF block is a flow feature that can't stop the attackers from changing codes. The Cloudflare web layer rules can buy additional hours of emergency windows and cannot replace the bottom solver. There's only one CISA proposal for running on the EOL version: pull the machine off the network.
Multinational government response levels actually reflect different resource constraints. The Government of Finland has directly dropped off its website for the general public; Prime Minister Takahumi of Japan has publicly stated that "it is also an effective measure to reduce risks by failing to fix temporary closures"; the NSA has issued updated instructions to all federal agencies using PHP; and Canada, the United Kingdom, Singapore, Australia and the European Commission have issued simultaneous alerts. Different actions, same logic: close the exposure to zero before the patch.
Experience suggests that the four-day window is not a PHP case. As long as the discovery of the side continues to be faster than the deployment, the margin in each of the " 2-day discovery + N-day repair" cycles is the natural field window period. Shortening N has two implementable paths: first, distribution of patches into the CI/CD streaming line, the deployment side at the same speed as the discovery side, and the hosting and cloud platform automatically triggers the upgrade at the same time as the bulletin publish; and second, the introduction of a mandatory quarantine mechanism for the EOL version, so that "temporary running" no longer amounts to "permanent running". Without these two, the next PHP2Shell window will only be longer because the speed of discovery is still rising.
Selective decision: Which path should your PHP asset take to repair
Decision sheet: Whether version x is hotly updated during maintenance period x
The php.net bulletin leaves only one sentence of judgement: "There is no complete mitigation; upgrading is the only safe option." But upgrading is only if you know which version you're running and which time you're running. Only 8.5.12, 8.4.27, 8.3.36, 8.2.35, 8.1 et seq. are not covered by the return transplant.
Three things to do in 72 hours.
First, an asset count. All production environments run php-v, cloud manufacturers control tables (AWS ECS, Alibaba Cloud function calculations, GCP Cloud Run) have batch pull-down PHP version numbers. The whole patch was broken in the absence of an empty tube.
Second, I can't go first. The CISA bulletin is worded in plain language: a system that runs at 8.1 and below, and that cannot be upgraded in large quantities in the short term, is disconnected. Finland, the Netherlands, Japan are already doing it. The WAF rules can buy buffers of four to six hours, but CPT-EU confirms that PoC is in circulation and buffers are not an option.
Third, look at the log. In the access log, grep abnormal multipart POST is requested to focus on the path to the PHP kernel handler directly bypassing the front end frame. If 404, follow 200, there's something in there.
Architectural Panorama: A map of the full chain of discovery, restoration, validation
Mermaid Flowchart and Key Card Point
The first four sections are linked to a pipeline, with only two places of real card time: the report (this time it is zero, AI throws up directly, PoC) and the patch back with ecosynchronization (the four parallel branches, WordPress downstream and Drupal maintainers have to be updated).
PHP2Shell, attack the entire chain.
Two figures complete the bottlenecks: two days at the end of the discovery and two months at the end of the repair. AI pushed the first half to its limit, and the second half was stuck on less than $700 a month to sponsor Debian packers and four branch porters. You bought the flagship money, and it suddenly turned into a simulator.
References
- Tencent Cloud Security Circular (CVE-2026-109618/[REDACTED]: claud.tencent.com/announce/de...
- 36 Kryptonian Report: www.36kr.com/p/40366693...
-Blogyard technology dismantling: www.cnblogs.com/xiobaysf/...
- Economic reference newspaper: jjckb.xinhuanet.com/20261022/f2...
- Tencent Cloud Developer Community: cloud.tencent.com/developer/a...
Extension entrance
- Original archive: tobemagic.github.io/ai-magician...
- WeChat Official Account: Computer magician
Auto-fetched and translated by AI Atlas. All rights belong to the original author.