AI 挖出的 PHP 漏洞让多国政府网站集体下线，曾因攻击成本太高而被搁置的老问题重新变成威胁，当发现和利用漏洞越来越容易，防守方修补系统的时间窗口却在迅速缩短。
头图图片来源：Wiz
10 月 21 日晚，如果你有在社交媒体冲浪的习惯，可能会发现一个奇怪的网站关闭潮：几乎是在同一时间，全球多个国家和地区的各种重要基础设施网站纷纷宣布临时关闭。
周三。芬兰政府把所有对外的网络服务关掉了；荷兰国家网络安全中心连自己的官网也撤了下来，鹿特丹港、荷兰足协、五大政党的网站和多家医院紧随其后；法国内政部让各省政府网站暂时下线，德国联邦 IT 服务商关掉了多个站点，比利时外交部、维基媒体基金会、任天堂，也相继停掉了部分服务。
荷兰政府宣布 DigiD 等网站预防性下线｜图片来源：Rijksoverheid
但这些网站其实都没有被黑，而是自己主动关掉的。
原因是 PHP 的两个漏洞：PHP 是世界上用得最多的网站后端语言，W3Techs 的统计里，能识别出后端语言的网站约七成跑在它上面。这两个漏洞被合称为 PHP2Shell，攻击者不需要登录，就有可能远程控制整台服务器。
最先找到它们的，是 AI。
不过 AI 找到漏洞早就不是新闻了。但据目前的公开报道，这是第一次，一个由 AI 挖出来的漏洞，让好几个国家的政府在同一天关掉了自己的网站。它真正宣告结束的，是网络安全里一条从没写进教科书、却一直在起作用的规矩：很多漏洞之所以安全，只是因为攻击它们太累了。
PHP 官方给这两个漏洞的严重程度评分都是 9.2（满分 10），安全公司 watchTowr 直接打了满分。
它们都出在 PHP 最底层的内存管理上，和网站自己的代码写得好不好无关。PHP 官方的说法是，所有处理网页请求的 PHP 都受影响；Cloudflare 说，受影响的版本一路追溯到十多年前的 PHP 5.4。PHP 基金会的 Volker Dusch 拿它和 2014 年的「心脏出血」比，说这是十多年来最严重的 PHP 安全问题。
让各国政府紧张的，是接下来混乱的 48 小时：漏洞原本处在保密期，按照行业惯例，软件方先把补丁准备好，再和发现者一起公开。
但 10 月 20 日，有人在 Hacker News 和地下论坛 BreachForums 上放出了消息，watchTowr 当天确认漏洞是真的。当晚，PHP 官方紧急宣布，补丁提前一天，在 21 日 14:00（UTC）发布。
补丁出来之前，攻击尝试就开始了。Cloudflare 的 CTO Dane Knecht 在补丁发布前近六小时就在 X 上说，「我们看到早期攻击正在出现」。美国国家安全局、英国国家网络安全中心、欧盟网络安全机构 CERT-EU 给出的建议几乎一致：来不及打补丁的系统，先下线。
于是就有了开头那一幕。
三家公司联合披露了这组漏洞｜图片来源：PHP2Shell
幽灵漏洞复活
PHP2Shell 最反常的地方在于，它并不新，它甚至并不是昨天刚刚发现的。
首个发现它的安全公司 Calif 在技术文章里，把它的源头追溯到 2004 年。在 20 年前，安全研究员 Stefan Esser 就发现过 PHP 在内存耗尽时的同类问题。2020 年，有人提交过相关的 bug 报告，几乎没人理会；2024 年，一次第三方资助的 PHP 安全审计又碰到了相关问题，但因为没能证明它真的可以被利用，最后没有修。
这个漏洞在 PHP 里躺了十多年，不止一次被人摸到了边，却一直没有人把它做成真正的攻击。
2020 年的 bug 报告，几乎没人理会｜图片来源：Calif
原因不是没人想到，而是太费劲。独立作者 Nick Rogers 在分析文章里说，把这类漏洞做成能用的攻击，需要「数周枯燥的手工调试」，过去没有人愿意为它付出这个成本。他给这种状态起了个名字：security by exhaustion，靠攻击者累到放弃来保证安全。
互联网底层大量的老代码，都处在这种诡异但拧巴的状态里。理论上有漏洞，但真要打起来各路神仙都又觉得太费劲，所以就这么一直放着。
改变这件事的，是今年 6 月 OpenAI 启动的一个计划「Patch the Planet」：出钱、出模型，请安全公司去审计那些被全世界依赖的开源软件。Calif 是参与者之一，它把目标定在了 PHP。
8 月 1 日，Calif 的研究员 Ryan Austin 带着 AI 开始审计。按照 Calif 公开的技术文章，AI 在这次审计里是「审计搭档」，也是 agent：它梳理 PHP 内核代码、追踪程序的执行路径，第一个漏洞的关键缺陷，就是 agent 在内核代码里发现的。开始审计后仅仅几天，第一个问题就浮出了水面。
8 月 11 日，Calif 把漏洞报告给了 PHP：团队让 AI 把第一个漏洞的「模式」总结成一份可复用的技能文件，专门用来搜寻同一类缺陷。第二个漏洞，就是靠这份技能文件找到的。
AI 找到一个漏洞之后，可以把找到它的方法打包，再去找下一个。
Calif 用漫画还原了 AI 审计的现场｜图片来源：Calif
哦顺道一提，按 OpenAI 在官方博文里的说法，Calif 这次没有使用类似 Daybreak 等专用 AI 网络攻防工具，也没有使用类似 Astra 这样的前沿旗舰模型，而是 GPT-5.6 Sol 这样更便宜的模型。
几乎同一时间，另一家安全公司 Wiz 也撞上了同一组漏洞。8 月 19 日，Wiz 的研究员借助自家工具 Wiz Atlas、Google 的 Gemini 4 Argon 和 OpenAI 的 GPT-5.6 Sol，独立发现了第一个漏洞。第二天，他们在 Drupal 上验证了远程执行代码；第三天，在 WordPress 上也验证成功。
Wiz 在博客里写道，前沿模型帮团队分析失败原因、反复调整，「几小时内」就让攻击在多种应用上跑通。它的结论是：「一名研究员一周完成了过去需要世界顶尖团队数月的工作。」Wiz 把这次发现里最大的功劳给了 Gemini 4 Argon，Google DeepMind 的 Gemini 安全负责人 Raluca Ada Popa 也出来说，这展示了「为什么前沿 AI 会改变网络防御的格局」。
两家公司、三个 AI 模型，三周之内，从两个方向撞上了同一组漏洞。OpenAI 和 Google 各自强调自家模型的贡献，这本身就说明，用 AI 找漏洞已经成了头部 AI 公司正面竞争的赛道。
AI 改变的，似乎并不只是「能不能发现」，更多在于「值不值得做」。当找漏洞、验证漏洞、把攻击适配到不同环境的成本，从「顶尖团队几个月」降到「一个人一周」，甚至「几个小时」，过去那些「太累了不值得」的漏洞，就全都变成了值得。Rogers 的说法是，AI 第一次把网络攻击的边际成本「推向了零」。
这也解释了为什么两家公司会在三周内撞上同一组漏洞。Calif 特别说明，最初发现漏洞时，「没有使用特殊的工具，也没有使用普通人拿不到的模型」。防守方用公开的模型能找到它，攻击方同样可以。
把 PHP2Shell 放回过去两年，能看到一条逐渐引燃导火索：2024 年 11 月，Google 宣布它的 AI 项目 Big Sleep 在数据库软件 SQLite 里找到一个此前未知的漏洞，称这是 AI 第一次在广泛使用的真实软件里发现可利用的漏洞。
今年 4 月，Anthropic 称 Claude Mythos 预览版在测试中找到了数千个零日漏洞，其中包括 OpenBSD 里一个存在了 27 年的漏洞，因为能力太强，这个模型没有公开，只提供给 40 多家维护关键软件的机构。
7 月，由 AI 发现的 WordPress 核心漏洞链 wp2shell 公开，随后被攻击者大规模利用。
从「能找到」到「让政府关站」，用了两年｜图片来源：极客公园
从「AI 能找到漏洞」，到「AI 找到的漏洞太危险，模型不敢公开」，再到「AI 找到的漏洞让政府网站关了门」。AI 对网络安全的改变，第一次从安全圈内部的技术新闻，变成了整个社会都感受得到的现实。
对当下这种乱成一锅粥的局面，OpenAI 在博文里也挽尊了一下：帮助发现漏洞的同一种能力，「也能帮攻击者快速开发攻击工具」。
这已经不是假设。PHP2Shell 公开当天，watchTowr 的研究员 Jake Knott 说，他们在诱饵服务器上观察到的攻击尝试，用的工具部分就是借助 AI 写出来的。「到目前为止还没有人成功，但我们不认为这能持续很久。」
过去一年，攻击者用 AI 的案例在急速升级。2025 年 11 月，Anthropic 披露，一个被它认定有国家背景的组织利用 Claude Code 对约 30 个目标发起入侵，攻击中 80% 到 90% 的战术操作由 AI 自主完成。
今年 5 月，Google 威胁情报团队报告，一个攻击者借助 AI 开发出了可用的零日漏洞攻击，计划发起大规模攻击，被 Google 提前拦了下来，这被认为是攻击者第一次成功用 AI 造出零日攻击。Google 威胁情报首席分析师 John Hultquist 说，AI 不仅能大规模审查代码找漏洞，还能「做出可用的攻击，而这曾经是一道很高的门槛」。
到了 9 月，Anthropic 的威胁情报报告里，案例已经变成了规模化作业：一个疑似与俄罗斯情报机构有关的组织，用 AI agent 在安全软件报警后自动重写恶意程序，目标包括 20 多家政府部门和国防机构；一群讲中文的操作者用 AI「agent 集群」做侦察和漏洞开发，其中一条流程在一个月里产出了十几个疑似零日漏洞；一名独立的黑客行动者，靠 AI 写出一个 WordPress 零日攻击，在 42 个目标里至少攻破了 14 个。
Anthropic 在报告里的说法是，AI 把成本又转嫁回了防守方。过去发起一次复杂攻击需要一个团队，现在一个人加上几个 AI agent 就够了。
防守方的时间窗口
PHP2Shell 公开当天，OpenAI 还给了一个判断：未来几个月，类似的发现会急剧增加。
这句话已经有数据在印证。PHP2Shell 公开的前一天，10 月 20 日，Google 发布了 Chrome 156 正式版，这一个版本修复了 353 个安全漏洞。一年前的 Chrome 141 和 142，这个数字分别是 21 和 26。
一年时间，单版本修复数涨了十倍以上｜图片来源：极客公园
报告人的名单也变了。Chrome 156 里最高等级的 6 个「严重」漏洞，有 4 个由 Anthropic 的研究员 Xinyang Ge 报告，其中一个明确标注「由 Claude 协助」；另有 1 个来自 OpenAI 的 Codex Security。AI 公司的名字，已经成批出现在全球用户最多的浏览器的安全公告里。
6 个严重漏洞，5 个由 AI 公司报告｜图片来源：极客公园
为什么会急剧增加，第一个原因就是找漏洞的方法可以复制了。PHP2Shell 里那份技能文件就是例子：过去，一个顶尖安全研究员的经验很难复制；现在，它可以变成一个文件，交给无数个 agent 同时去跑。
事实上，如今互联网上仍等着被挖的「存量」太大了。互联网的底层，是几十年积累下来的老代码，PHP、浏览器、操作系统、各种开源库。像 PHP2Shell 这样「早就有人摸到边、只是太难打」的漏洞，在这些代码里还有多少，没人数得清。过去它们靠「太累了」被保护着，这层保护正在消失。
这也是为什么各家前沿 AI 研究机构都在加码。Anthropic 把 Mythos 提供给 40 多家关键软件机构，OpenAI 为 Patch the Planet 拿出 10 亿美元等值的使用额度，Google 有 Big Sleep，Wiz 这次也押上了 Gemini。头部 AI 公司都把「用 AI 找漏洞」当成了展示模型能力的主战场。但别忘了，攻击者手里的 AI，和防守方用的往往也是同一代模型。
OpenAI 把发现漏洞到攻击者开始利用之间的这段时间，叫做「防守方窗口」。PHP2Shell 的窗口原本有两个多月，一次提前泄露，就把它压缩到了几个小时。
AI 让找到漏洞变得前所未有地容易，修补却还得一台服务器一台服务器地做。PHP 只为 8.2 到 8.5 四个版本发布了正式修复，安全公司 Mallory 统计，补丁发布前一天，互联网上约有 88 万台服务器还在对外显示 PHP 8.1 或更老的版本。对它们来说，「理论上有漏洞，实际上没人会打」的那份安全感，已经没有了。
政府网站因为一个 AI 挖出的漏洞集体关门，这次应该是第一次，但看起来，很难是最后一次。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The PHP loophole that AI has dug has re-emerged the old problem of multiple government websites that were put on hold because of the high cost of the attack, and the time window for the defence repair system is rapidly shrinking when it becomes easier to detect and exploit it.
Photo by Wiz.
On the evening of October 21st, if you're used to surfing in social media, you may find a strange wave of website closures: almost at the same time, various critical infrastructure sites in various countries and regions around the world are being temporarily closed.
Wednesday. The Government of Finland has shut down all its external Internet services; the National Cyber Security Centre in the Netherlands has withdrawn its own network of officials, followed by the Port of Rotterdam, the Dutch Football Association, the web sites of the five major political parties and hospitals; the French Ministry of the Interior has temporarily shut down provincial government websites, the German Federal IT Service has shut down several sites, and the Belgian Ministry of Foreign Affairs, the Wikimedia Foundation, Nintendo and others.
The Government of the Netherlands announces that websites such as digiD have a preventive offline photo source: Rijksoverheid
But none of these sites were actually hacked and turned off on their own initiative.
The reason for this is two loopholes in PHP: PHP is the most used back-end language in the world, and in W3Techs statistics, about 70 percent of the sites that recognize the back-end language run over it. These two loopholes are collectively referred to as PHP2Shell, and without the need for log-in, it is possible to control the entire server remotely.
The first to find them was AI.
But AI finds a loophole is no longer news. However, according to current public reports, this was the first time that AI had dug a loophole that had led several Governments to shut down their websites on the same day. What it really ends is a rule in cybersecurity that has never been written in textbooks, but has worked: many loopholes are safe only because they are too tired to attack.
PHP officially rated the seriousness of both loopholes as 9.2 (full 10), and the security company watch Towr had a full score.
They're all out of PHP's bottom memory management, not about how the site's own code works. The official version of PHP is that all PHPs dealing with web-page requests are affected; Cloudflare states that the affected version dates back to PHP 5.4 more than a decade ago. Volker Dusch of the PHP Foundation compared it to the "heart hemorrhage" of 2014, saying it was the worst PHP security problem in over a decade.
What makes Governments nervous is the ensuing confusion of 48 hours: the loophole was in the confidentiality phase, and according to industry practice, the software side prepared the patch and then made it public with the discoverer.
But on October 20th, someone posted news on Hacker News and BlackForums, and watchTowr confirmed that the leak was real. That night, PHP officially announced that patches were one day ahead of schedule at 14:00 (UTC) publish.
Before the patch comes out, the attack attempt begins. CTO Dane Knecht from Cloudflare said, "We see early attacks coming," almost six hours before the patch publish. The National Security Agency (NSA), the British National Cyber Security Centre (BNSC) and the European Union Cybersecurity Agency (EU), CPT-EU, made almost identical suggestions: the system of patching is too late to go down.
So there's the opening scene.
The three companies jointly disclosed the source of the leak: PHP2Shell
The ghost's hole is back.
The most unusual thing about PHP2 Shell is that it's not new, it's not even found yesterday.
The first security company that found it, Calif, went back to 2004 in a technical article. Twenty years ago, a safety researcher, Stefan Esser, discovered similar problems when PHP was running out of memory. In 2020, the relevant bug report was submitted with virtually no attention; in 2024, a third-party-funded PHP security audit encountered problems but failed to prove that it was really usable and was not repaired.
This loophole has been lying in the PHP for more than a decade, more than once being touched, and nobody has ever made it into a real attack.
In 2020's bug report, little attention was paid to the source of the photo: Calif
It's not because nobody thought about it, it's because it's hard. Independent author Nick Rogers, in an analytical article, said that making such a loophole a viable attack would take weeks of "dry manual debugging" for which no one had ever been willing to pay. He gave a name to this state of affairs: security by exhaustion and safety by the aggressor's exhaustion.
There's a lot of old codes at the bottom of the Internet, all in this weird but twisted state. Theoretically there is a loophole, but it's too hard to fight the fairies, so it's just been there.
The change was made in June of this year by Open AI, a project called "Patch the Planet": pay, model, and ask security companies to audit open-source software that the world depends on. Calif was one of the participants, and it set the target on PHP.
On 1 August, Ryan Austin, a researcher from Calif, started the audit with AI. According to Calif's open technical article, AI was the "audit partner" in this audit and angent: it combs the PHP kernel code, tracks the program's execution path, and the key flaw of the first loophole is that it was discovered in angent kernel. Only a few days after the audit began, the first problem surfaced.
On August 11th, Calif reported the leak to PHP: The team asked AI to summarize the first loophole's “mode” into a reusable skill document designed to search for the same kind of defect. The second loophole was found on this skill paper.
Once AI finds a loophole, we can pack up the way to find it and find the next one.
Calif returned the AI. Audited live photo source: Calif
Oh, by the way, according to Open AI in official Boven, Calif did not use a dedicated AI cyber-defense tool like Daybreak this time, nor a forward flagship model like Astra, but rather a cheaper model like GPT-5.6 Sol.
At almost the same time, another security company, Wiz, ran into the same loophole. On 19 August, Wiz researchers independently discovered the first loophole through their own home tool Wiz Atlas, Gemini 4 Argon in Google and GPT-5.6 Sol in Open AI. The following day, they validated the remote execution code on Drupal; on the third day, they also verified it on WordPress.
Wiz writes in his blog that the front-line model helps teams to analyze the reasons for their failure and to adjust over and over again, and that "in a few hours" the attack runs through many applications. It concluded: "A researcher completed a week of work that used to take several months of the world's top team. Wiz gave Gemini 4 Argon, Google DeepMind, the Gemini security chief, Raluca Ada Popa, the greatest credit for this discovery, and said, "Why is Front Line AI changing the pattern of cyber defense?"
Two companies, three AI models, hit the same loophole in two directions within three weeks. Open AI and Google each emphasize the contribution of their own models, which in itself shows that the use of AI to find loopholes has become a competitive track for head AI companies.
AI seems to have changed more than "can we find out" but more about "value is not worth doing." When a loophole is found, a loophole is verified, and the cost of adapting the attack to different environments is reduced from "the top team for months" to "one person for a week" and even "a few hours", the loopholes of the past were all worth it. According to Rogers, for the first time, AI pushed the marginal cost of cyber attacks to zero.
This also explains why two companies hit the same loophole within three weeks. In particular, Calif explained that when a loophole was first discovered, “special tools were not used, nor were models not available to ordinary people”. The defensive party can find it using an open model, as can the attacking party.
Put PHP2Shell back in the last two years and see a gradual fuse: in November 2024, Google announced that its AI project Big Sleep found a previously unknown loophole in the database software SQLite, which it claims is the first time that AI has discovered an available loophole in a widely used real software.
In April this year, Anthropic called Claude Mythos ' preview found thousands of zero-day holes in the test, including a 27-year gap in OpenBSD, because of its power, the model was not made public and was provided to more than 40 institutions maintaining critical software.
In July, WordPress' core loophole, discovered by AI, wp2shell was released and subsequently used on a large scale by the attackers.
From "Find" to "Close the government."
From "AI finds a loophole" to "AI finds a loophole too dangerous for models to be made public" and "AI finds a loophole that shuts the government website." For the first time, changes in cyber security have evolved from technical news within the circle to a reality that society as a whole feels.
In the current situation of chaos, Open AI also held up in Boven: the same ability to help detect loopholes, "and help attackers develop tools quickly."
That's no longer hypothetical. On PHP2Shell's public day, a watchTowr researcher, Jake Knott, said that some of the tools they had observed on the bait server were written by AI. "No one has succeeded so far, but we do not think it will last for long."
Over the past year, the case of the attackers using AI has escalated rapidly. In November 2025, Anthropic disclosed that an organization that it had identified as having a national background had used Claude Code to launch an invasion against about 30 targets, and 80 to 90 per cent of the attacks had been conducted autonomously by AI.
In May this year, Google Threat Intelligence reported that one of the attackers, using AI, developed a zero-day loophole attack and planned to launch a large-scale attack, which was stopped earlier by Google, which was considered the first successful one with AI. Google Threat Intelligence Chief Analyst John Hultquist said that AI was not only able to review the code on a large scale to find loopholes, but also to "make an available attack, which used to be a high threshold".
By September, in a threat intelligence report from Anthropic, the case had turned into a scale operation: an organization suspected of being linked to Russian intelligence services, using AI angent, automatically rewrites malicious programs after security software alerts, targeting more than 20 government departments and defence agencies; a group of Chinese-speaking operators, using AI “agent cluster” to detect and exploit loopholes, one of which produced more than a dozen suspected zero-day loopholes in a month; an independent hacker, using AI to write a WordPress zero-day attack, broke at least 14 out of 42 targets.
In the report, Anthropic stated that AI had transferred the costs back to the defense. A complex attack in the past required a team, and now it's enough for one person to add a few AI parties.
Defence time window
PHP2Shell on the public day, Open AI also gave a judgment that similar discoveries would increase dramatically in the coming months.
This statement is supported by data. The day before PHP2Shell was released, on 20 October, Google Z.94Z made the Chrome 156 official version, which repaired 353 security loopholes. Chrome 141 and 142 a year ago, the figures were 21 and 26, respectively.
Over the course of a year, the number of single-version restorations increased by more than 10 times the source of the photo: Polar Park
The list of reporting persons has also changed. Six of the top-level "serious" loopholes in Chrome 156, with four Xinyang Ge reports by Anthropic researcher, one of which clearly labels "with the assistance of Claude", and one from Open AI for Codex Security. The name of AI has appeared in bulk in the security bulletins of the most user browser worldwide.
6 serious loopholes, 5 by AI reporting photo sources: Polar Park
The first reason why there has been a sharp increase is that the way to find a loophole can be replicated. The skill paper in PHP2Shell is an example: in the past, the experience of a top security researcher was hard to replicate; now, it can become a document that can be handed over to countless delegates while running.
In fact, the Internet is still too big to be dug up. The bottom of the Internet is the old code accumulated over the decades, the PHP, the browser, the operating system, the various open source repositories. PHP2Shell, "Someone's been touching it, it's just too hard," and there's not a lot of people in these codes. In the past, they were protected by "too tired" protection, which was disappearing.
And that's why all the AI. research institutions are adding numbers. Anthropic gave Mythos to over 40 key software institutions, Open AI putting out a billion-dollar equivalent for Patch the Planet for quota, Google with Big Sleep, Wiz and Gemini this time. Head AI uses "Ai to find a loophole" as the main field of demonstration of model capabilities. But don't forget, the Al in the hands of the attackers, and the defence are often the same models.
Open AI calls the "defensive window" between the discovery of a loophole and the start of the attacker. The PHP2Shell window had been leaking for more than two months, and it had been condensed for hours.
AI makes it easier to find a loophole than ever before, and fixes it with a server. PHP has only been officially repaired for 8.2 to 8.5 versions of publish, security company Mallory Statistics, patches publish the day before, about 880,000 servers on the Internet were still showing PHP 8.1 or older versions to the outside world. For them, there is no sense of security for "theoretically there is a loophole, and in fact no one can fight."
The government website was shut down for the first time because of an AI leak, but it seemed hard to last.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.