新智元报道
出大事了！
连账号密码都不用，黑客就可能让网站服务器听命于自己！
就在刚刚，OpenAI公开了一起惊心动魄的幕后行动：GPT-5.6 Sol从全球70%网站都在用的PHP语言里，挖出了两个致命漏洞。
一旦被利用，攻击者连账号密码都不用输，直接就能让服务器乖乖执行恶意代码。
甚至，连平日里专门教别人防黑客的荷兰国家网安机构，收到风声后的第一反应，都是赶紧把自家的官网给关了！
为了堵上窟窿，OpenAI和PHP维护者秘密死磕了两个月，不惜推翻重来，连PHP引擎的内存管理机制都改了。
然而，保密了两个月，却在最后48小时彻底崩盘——
漏洞消息先泄露，倒逼补丁提前一天上线；随后攻击演示视频意外流出，修复镜像提前公开。
还没等全球站长们反应过来打补丁，第一波真实攻击就已经在路上了。
更让人后背发凉的是，OpenAI顺手还埋了个彩蛋：这两个只是开胃菜，另外几项重大漏洞，还在排队抢修中……
这次PHP爆雷，三点看懂：
- 两个高危漏洞：PHP是网站常用的后台语言。在受影响的部署中，攻击者可能无需登录，就让服务器执行恶意代码。
- GPT参与找洞：Calif借助GPT发现漏洞，Wiz也独立发现；PHP维护者主导修复，OpenAI协调各方。
- 补丁已经发布：网站运营者需要升级PHP，临时防护不能替代补丁。
这场秘密抢修，最后连负责防黑客的机构都得先关站避险。补丁还没赶到，官网先下线。
10月21日，荷兰国家网络安全中心NCSC选择先关站，等修复。
关站的还不止它。荷兰司法系统的招聘网站、司法培训机构网站也暂停服务，连给记者传送庭审信息的文件信箱都临时关闭了。
日本财务省同样停了官网的部分内容和服务，紧急检查服务器、安装修复。
引发关站的两个PHP引擎漏洞，合称PHP2Shell，CVSS危险评分都达到9.2分，满分10分。
其中最危险的后果，叫远程代码执行，简称RCE。网站本来只该处理访问者发来的请求，结果却可能开始执行攻击者指定的代码。
Wiz用当时最新的WordPress、Drupal、Joomla镜像搭建测试环境，复现了无需登录的远程攻击，还验证了从内存中读取密码、令牌和API密钥的攻击路径。
甚至，在某些Apache与mod_php部署中，攻击在网站自己的程序启动前就能发生。哪怕页面只写了一行「Hello World」，也可能中招。
麻烦在于，用PHP的网站太多了。W3Techs能识别服务端语言的网站中，69.3%使用PHP。底层引擎出了问题，大量网站都得跟着检查、升级。
把时间拨回7月30日，Calif研究者Ryan Austin开始审计PHP。他参与OpenAI的Patch the Planet计划，要用AI帮开源项目找洞、修洞。
到8月1日，多条远程攻击路径就被找了出来。
早在2004年，PHP的内存限制机制就被发现存在远程攻击漏洞。Ryan让GPT-5.6 Sol以此为切入点，检查现有代码里是否还藏着同类问题。
程序处理请求，要把数据临时放进内存。PHP给每次请求划了额度，用光就要中断处理。这种情况叫内存耗尽，也就是OOM。
Calif披露的一条攻击路径中，不到8MiB的请求数据，处理时却足以耗尽PHP默认128MiB的内存额度。
小小的请求进入PHP后，会被拆成大量记录，每条都要额外占用内存。攻击者就利用这层放大，让程序在特定一步耗尽额度。
按PHP的规矩，这时应该中断操作，转去报错、清理。
偏偏就在这个时候，数据可能只填了一半。
模型在PHP内部存放数据的哈希表里，发现了一个危险顺序：新增记录时，先把记录数加一，才申请内存、填入内容。
如果申请内存时正好耗尽额度，程序就会跳走。新记录还没填好，计数却已经加了。
清理程序照着计数检查，便把尚未准备好的内存当成有效记录使用。相当于表格里一行还没填完，已经被当成完整记录拿来用。
把这种错误变成远程攻击，还要安排相关内存内容、满足具体运行条件。研究者已经在受影响的部署中，让程序执行了攻击者指定的代码。
研究者没停在这个洞上。他们让模型把刚发现的错误模式写成SKILL.md，一份可以反复使用的审计指引，再沿着同样的线索查下去。
这一查，Agent又在负责记录文件上传进度的代码里，找到了另一个问题。
一次请求异常结束，内存被释放，但处理请求的程序还留着旧地址。等它接到下一次请求，又可能拿这个地址去读取已经失效的内存。
这就是释放后使用，也叫UAF。相当于一条登记已经作废，程序却仍照着旧地址找数据，而那块内存可能已被重新分配。
另一边，Wiz也独立找到了两个漏洞。PHP版本一换、运行环境一变，原来的攻击就可能失效，模型还得跟着分析崩溃、调整验证。
Wiz研究员Sagi Tzadik在X上写道：「AI干了这里的大部分工作。」
几天就找出了攻击路径，后面的修复准备却忙了两个月。
这次由OpenAI牵头协调，PHP维护者主导修复。但两个漏洞牵着引擎的内存管理和错误处理，堵住眼前的攻击路径，同类问题还可能从别处冒出来；大改底层，又得保证旧程序和扩展还能跑。
PHP基金会说，团队连周末都在昼夜协调。补丁要在多个版本上测试，还得让发行商打包、让安全厂商准备防护。
最终，PHP连中止工作的时机都改了。
修补后的PHP设了两道内存上限。触及软限制，等程序走到安全位置再处理，避免留下半成品数据；触及更高的硬限制，就让进程退出，阻止危险状态被继续使用。
各方原本约好，10月22日晚10点统一发布。
可到了20日晚11点左右，两个漏洞编号突然在网上流传，还混着错误的发布时间和满分10分的评分。此时，离原定发布已经不到48小时。
21日凌晨3点半，PHP团队提前发出预告，把正式发布往前挪了整整24小时。
但通知发了，不等于更新就能装上。发行商还在打包，再提前，用户就会先知道自己有危险，却拿不到方便安装的更新。
预告发出约半小时，攻击演示视频也漏了。
PHP基金会复盘称，Calif误发了攻击演示。视频很快被删，副本却已经传了出去。
到了21日下午，连含修复的构建镜像也提前公开了。Chainguard发布这些镜像后，外界已经可以对比新旧代码，反推漏洞在哪儿。
同日下午3点43分，Cloudflare首席技术官Dane Knecht在X上发帖：已经看到了早期攻击。
他发帖时，补丁计划到当晚10点才统一发布。攻击已经来了，还有六个多小时要撑。
Cloudflare后来还披露，攻击者已经在改请求，试着绕过防护规则。
Cloudflare给使用其Web应用防火墙的免费和付费客户部署了保护，但Dane强调，这只是临时措施，补丁出来就得安装。
21日晚，PHP8.5.12、8.4.27、8.3.36和8.2.35终于发布。PHP团队还为7.4、8.0和8.1准备了最小范围的源码修补，供发行商和长期支持服务制作更新包。
22日零点35分，OpenAI又放出一个Codex检查skill，帮网站运营者检查PHP版本，判断是否可能受影响。
它查的是PHP版本，不能替网站完成升级；如果连版本都查不到，也不能据此认定安全。
而OpenAI已经预告：PHP只是团队已发现、正在修复的多项重大漏洞之一。
未来几个月，这类发现预计还会显著增加！
参考资料：
https://x.com/OpenAI/status/2112907856018309586
编辑：摩西 桃子
不喜欢
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
New Ji-won.
Something's wrong!
If you don't even use the account codes, hackers can get the website servers to follow their orders!
Just a moment ago, Open AI made public an exciting behind-the-scenes move: GPT-5.6 Sol has dug up two fatal holes from the PHP language that 70% of the world's websites use.
Once used, the attackers do not have to lose even the account codes, so that the servers can enforce the malicious codes.
Even the Dutch National Cyber Security Agency, specializing in hacking, was quick to shut down its own official network.
Open AI and PHP maintainers have been in secret for two months in order to block the hole, and even the memory management mechanism for the PHP engine has been changed in the face of the reversal.
However, it was kept secret for two months, but it collapsed in the last 48 hours -
The leaks were leaked and the patches were forced to go online one day in advance; the video of the attack was subsequently unexpectedly released and the restoration mirrors were made public in advance.
The first wave of real attacks is on its way before the global station chiefs respond to the patch.
And even cooler backs, OpenAi has buried an egg: These two are just appetizers, and several other major loopholes are still waiting for repairs...
This time, the PHP blast, it's three o'clock:
- Two high-risk gaps: the PHP is a common back-office language of the website. In the affected deployments, the attackers may not need to log in and allow the server to enforce the malicious code.
- GPT was involved in the search for holes: Calif was able to identify holes through GPT, and Wiz was able to do so independently; PHP maintainers took the lead in repairing and Open AI coordinated the parties.
- Patch has been publish: website operators need to upgrade PHP and temporary protection cannot replace patch.
In the end, even the agency responsible for hacking had to shut down and avoid the risk. The patch hasn't arrived yet.
On 21 October, the Netherlands National Cyber Security Centre NCSC chose to close the site and wait for rehabilitation.
It's more than that. The recruitment website of the Dutch judicial system and the website of the Judicial Training Institute were also suspended, and the document mailbox for the delivery of court information to journalists was temporarily closed.
The Ministry of Finance of Japan also suspended some of the content and services of the official network, urgently inspecting servers and installing repairs.
The two PHP engines at the closure station, jointly known as PHP2Shell, were given 9.2 points for the CVSS hazard rating of 10 points.
The most dangerous of these is called remote code execution, known as RCE. The website should have dealt only with requests from visitors, but as a result it might have begun to implement the code designated by the attackers.
Wiz used the current WordPress, Drupal, Joomla mirrors to build a test environment, to reproduce a remote attack that did not require login, and to verify the path of the attack to which the passwords, tokens and API keys were read from the memory.
Even in some Apache and mod php deployments, attacks can occur before the website's own program starts. Even a page with a single line "Hello World" could be a hit.
The problem is, there's too many websites using PHP. Of the web sites where W3Techs can identify service-end languages, 69.3 per cent use PHP. There was a problem with the bottom engine and a large number of websites had to be checked and upgraded.
Turning back time to 30 July, Ryan Austin, a Calif researcher, began auditing PHP. He's part of the Open AI Patch the Planet project, which uses AI to find holes and repair holes.
By 1 August, multiple long-range attack paths had been found.
As early as 2004, PHP's memory limitation mechanism was found to have a remote attack gap. Ryan asked GPT-5.6 Sol to use it as an entry point to check whether the same problem was still hidden in the existing code.
The procedure handles the request and temporarily places the data in the memory. PHP crossed each request with quota and the process was interrupted by the use of light. This is called depletion of memory, or OOM.
In one of the attack paths revealed by Calif, the requested data for 8MiB were less than 8MiB and were processed sufficiently to exhaust PHP ' s default memory of 128MiB.
When a small request enters the PHP, it is broken into a large number of records and each requires additional RAM. The attackers used this layer to zoom in and to exhaust quota at a specific step.
According to PHP rules, the operation should be interrupted at this time and referred to error reporting and clean-up.
At this point in time, only half the data may have been filled.
The model found a dangerous sequence in the Hashi table, where data were stored within PHP: when new records were added, the number of records was added before the memory and content were requested.
If the application for memory runs out of quota, the procedure will jump. The new records have not been completed, but the count has been added.
The clean-up process was counted and used as a valid record of unprepared memory. The equivalent of a line in the form has not been completed and has been used as a complete record.
Turning this error into a long-range attack will also require the relevant memory content to meet specific operational conditions. Researchers have already allowed the programme to implement the code designated by the attackers in the affected deployments.
The researchers didn't stop in this hole. They had the model write down the newly discovered error pattern as SKILL.md, an audit guide that could be used repeatedly and then followed the same lead.
In this inspection, Agent found another problem in the code for recording the uploading of documents.
One request was abnormally closed and the memory was released, but the procedure for processing the request left its old address. When it receives its next request, it may take this address to read the expired memory.
That's what after release, also called UAF. The equivalent of a registration that has been invalidated, the process is still searching for data at the old address, and the memory may have been redistributed.
On the other side, Wiz had found two loopholes independently. As soon as the PHP version is changed and the operating environment changes, the original attack may fail and the model will have to be analysed for collapse and adjusted for validation.
The Wiz researcher Sagi Tzadik wrote on X: "Ai did most of the work here."
The path of the attack was identified in a few days, while the rest was prepared for repair for two months.
This time, it was coordinated by Open AI and led by the PHP maintainer. However, two loopholes are associated with the memory management and mishandling of the engine, blocking the immediate path of attack, and similar problems may emerge elsewhere; a major change in the bottom would ensure that old programs and extensions can run.
The PHP Foundation stated that the team coordinated all weekends. The patch has to be tested on multiple versions and the issuer has to pack and the safety vendor has to be prepared for protection.
Finally, PHP changed the timing of the suspension.
The repaired PHP established a two-track RAM cap. Touching soft limits, when the program moves to a secure location for processing so as to avoid leaving semi-finished data; touching higher hard limits allows the process to exit and prevents dangerous conditions from being used.
The parties had agreed to unify publish at 10 p.m. on 22 October.
By around 11 p.m. on the 20th night, two loopholes were suddenly circulated online, mixed with the wrong publish time and 10 points. At that time, less than 48 hours had elapsed since the original publish.
At 3:30 a.m. on 21 a.m., the PHP team issued an advance warning and moved the official publish forward for 24 hours.
The notice, however, is not equivalent to an update to be installed. The issuer is still packing, and in advance, the user will know that he or she is in danger, but will not be able to get a convenient update.
The advance was about half an hour, and the video of the attack was missing.
The PHP Foundation repeated that Calif had made the wrong attack demonstration. The video was quickly deleted and a copy was sent out.
By the afternoon of the 21st, even the reconstructed building mirrors were made public. The mirrors of Chainguard publish have allowed the outside world to compare the old and new codes and to push the gap.
At 3.43 p.m. the same day, Senior Technical Officer Dane Knecht of Cloudflare posted on X: early attacks were seen.
At the time of his posting, the patch was not planned until 10 p.m. until publish. The attack has come and we have six hours to go.
Cloudflare later disclosed that the attackers were already changing their requests to try to circumvent the protective rules.
Cloudflare deployed protection to its free and paid clients using its Web application firewall, but Dane stressed that it was only a temporary measure and that the patch had to be installed.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were finally publish on the night of 21st. The PHP team has also prepared a minimum range of source code patches for distributors and long-term support services.
On 22 December, at 0035 hours, Open AI released a Codex check-skill to help website operators check PHP versions to determine whether they could be affected.
It was looking at PHP versions and could not be upgraded for the website; if not, it could not be considered secure.
Open AI has predicted that PHP is just one of the major gaps that the team has discovered and is repairing.
Such discoveries are expected to increase significantly in the coming months!
References:
https://x.com/OpenAI/status/2112907856018309586
Editor: Moses Peach
I don't like it.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.