收到紧急更新通知时，攻击已经开始了
打开 PHP 2026 年 10 月 21 日的安全公告，标题里有两个词，update now。
立即更新。
再往下读，两个核心漏洞可能让未登录的攻击者在服务器上执行代码。PHP 官方提到，已有 mod_php 利用演示能在业务代码开始运行之前触发攻击。登录校验、权限检查，这时候都还没执行到。
负责维护网站的人，要先确认承载这些代码的 PHP 有没有修好。PHP 官方公告
但外部请求不会等更新完成。
Cloudflare CEO Matthew Prince 表示，公告前十小时，Cloudflare 网络已看到数千次利用尝试；公告后四十五分钟达到数万次，两小时内达到数十万次，随后升至数百万次。404 Media 报道引用了他的这组数据。
这里统计的是利用尝试，包括被拦截的请求，不能换算成成功入侵数量；Cloudflare 的观测也不代表整个互联网的完整统计。
即便如此，两小时还是足够让人重新想想，安全更新到底能不能再慢慢排期。
我重新对照了研究者和维护者的原始报告。这次最值得追问的，已经不只是 AI 能不能找到漏洞。
一个存在多年的问题，为什么现在成了紧急事件？防守方已经提前准备，为什么公开披露时，网站仍然需要争分夺秒？
先把几条并行推进的线索放在一起看：研究者发现问题、维护者协调修复、外部利用和公开披露，并不沿同一节奏发生。
图中时间节点依据下文引用的原始材料整理，截至 2026 年 10 月 23 日；节点间距不代表实际时长，前后排列也不表示已经确认因果关系。
PHP2Shell 的风险，不能只看漏洞数量
PHP2Shell 是 CVE-2026-109618 和 CVE-2026-109619 的合称。问题位于 PHP 运行时，涉及内存耗尽或致命错误之后，未正确初始化的数据和已经释放的内存仍被继续使用。
修的是这一层，只更新插件、改业务代码，覆盖不了问题。
Wiz 的研究报告称，受影响版本可追溯至 PHP 5.4，近十年发布的每个 PHP 版本至少受到其中一个问题影响。研究团队还演示了无需实现远程代码执行，就能读取进程内存中密码、令牌和 API 密钥的路径。Wiz 研究报告
所以，只盯着服务器有没有被执行命令，也可能漏掉信息泄露。
同样需要分清，PHP 使用广泛，不能被写成全球同样比例的网站已经失陷。实际风险还要看运行时版本、部署方式、可利用路径与防护。研究者演示成功，也不等于所有环境都能用同一份程序直接打通。
恰恰是最后这件事，让 AI 的作用变得具体了。
AI 改变了什么，从发现问题到做出可用利用
OpenAI 确认，Calif 在 Patch the Planet 计划中使用 GPT-5.6 Sol 找到了一项关键漏洞，Wiz 也独立发现并报告了两个漏洞。PHP 维护者主导修复和发布，合作伙伴提供研究、技术支持与协调。OpenAI 事件说明
截图来自OpenAI 官方中文版，截取于 2026 年 10 月 23 日。
Wiz 则把研究过程里的困难讲得更清楚。复杂内存漏洞需要串联多个问题，遇到不同 PHP 版本、配置和内存布局，还得重新测试和调试。Wiz 称，研究使用了 Wiz Atlas、Gemini 4 Argon 和 GPT-5.6 Sol，模型帮助团队调整利用程序、分析失败并反复验证，降低了跨环境适配所需的专业投入。
这比一句 AI 找洞更值得留意。
过去，一个缺陷即使存在，复杂的利用条件也可能限制它的实际影响。当分析、调试和适配变得更容易，这个限制就会减弱。这是 Wiz 对本次研究的判断，也解释了为什么仅仅数漏洞数量，看不完整这次变化。
不过，研究团队公开使用模型开发利用，与互联网上每个攻击者都用了 AI，仍是两回事。后者不能从请求数量里推出来。
修复为什么慢，披露又为什么被提前
PHP Foundation 的复盘补上了维护者这一侧的背景。2024 年审计后的修复工作中，团队已发现 OOM 问题的早期迹象，但当时没有明确的远程代码执行路径。几种修复方案分别涉及兼容性、拒绝服务风险和扩展适配，叠加人手与决策机制的限制，工作反复停滞。基金会承认，这属于结构性失败。PHP Foundation 复盘
我觉得这段说明很重要。看到严重漏洞多年未修，质疑是合理的；但真正改进响应，还得知道卡在技术取舍、决策还是资源上。
维护者也得面对另一个现实。补丁改的是大量请求都会经过的内存管理和错误处理逻辑，修复时还要保住兼容性、性能与扩展生态。发现可靠利用之后，上游修复和下游准备，都还有工作要做。
Calif 的研究记录把审计起点列在 7 月 30 日，8 月 1 日记录了早期发现。随后还在寻找更多变体。Calif 研究记录
这能说明早期进展很快，但不能简单压成两天发现、两个月都在写补丁。确认影响、寻找变体、验证修复、协调分发，属于不同阶段。
发布前，协调过程又被打乱。
据 PHP Foundation，10 月 20 日 CVE 编号提前流传，还伴随错误的 10.0 评分，实际为 9.2。PHP 把发布从 22 日提前到 21 日；发行方尚在打包，立即公开会让许多用户缺乏便捷更新路径。随后误发的演示视频又增加了公开信息。
提前一天，是速度与更新可用性之间的折中。越多人需要提前获知信息才能准备保护，保密协调也越难。
提前发现与披露前利用，可以同时发生
AWS 的 MadPot 遥测记录显示，10 月 17 日已有一次 PHP2Shell 利用尝试，比公开披露早四天。来源 IP 与商业匿名化网络有关；AWS 认为可能来自威胁行为者，但尚不清楚对方怎样取得利用信息。AWS 遥测说明
中文译文，非官方中文版。据上方 AWS 官方原文翻译制作，原文核对日期为 2026 年 10 月 23 日。
OpenAI 称，据其所知，前沿 AI 比攻击者更早发现漏洞。这和 AWS 的记录不必然冲突。
一个比较研究发现与攻击者发现的先后，一个记录公开披露前已经出现的活动。研究者提前知道问题，不保证整个保密期里都没有别人找到它。
还有一个时间关系不能倒过来。10 月 17 日的利用尝试，早于 PHP Foundation 记录的 20 日公开泄露。后来的泄露不能直接解释更早的请求；是否还有其他信息流出，或者独立发现，目前不能据此下结论。
所以，那四天最能改变的，是调查起点。
补丁装好以后，旧日志仍然要查。相关请求可能早就到过服务器，异常文件、陌生进程和不该出现的外连，不会随着版本号更新自动消失。
提前防护能争取时间，不能替代实际修补
提前准备当然有价值。Cloudflare 表示，相关 WAF 防护从 10 月初开始准备，并在 10 月 21 日 UTC 03 时 02 分，也就是北京时间 11 时 02 分，默认向使用免费或付费 WAF 的客户启用。Cloudflare 防护报告
中文译文，非官方中文版。据上方 Cloudflare 官方原文翻译制作，原文核对日期为 2026 年 10 月 23 日。
源站还没升级，流量入口先有了一层防护，这就是提前发现争取到的时间能发挥作用的地方。
但主域名走了 WAF，源站能不能直接访问？后台域名和测试环境，是不是也经过同一层保护？一个入口的拦截记录，无法替其他入口作保证。
NSA 的官方警告把处置要求说得更直接，尽快盘点依赖 PHP 的服务并应用补丁；如果不能立即更新，建议下线，直到能够充分缓解风险。NSA 官方警告
这里的下线是降低暴露的措施，不能拿来当成服务已经被攻破的证据。
Cloudflare 与 AWS 也仍要求更新 PHP。WAF 是额外保护，完整修复需要落到运行时。AWS 缓解指南
下次收到更新通知，怎样确认系统真的修好了
截至本文核对资料的 2026 年 10 月 23 日，PHP 公告列出的本次修复版本是 8.2.35、8.3.36、8.4.27 和 8.5.12。旧分支使用者需要确认供应商的回移补丁，或者迁移到受支持版本。存在回移修复时，不能只凭上游版本号判断是否安全。
在命令行敲一次 php -v，查到的只是那个命令调用的二进制。真正接收请求的 PHP-FPM、mod_php 是否加载了修复版本，还得确认。镜像更新了，所有副本有没有替换；软件包安装了，worker 有没有重启，也要有实际结果。
对我来说，这次事件最能转成行动的，是三件事。
把受影响实例找齐，负责人、软件包或镜像摘要，都能对应上。
核验所有可访问入口的防护范围，确认服务进程已经更新，关键业务仍能运行。
从最早已知利用时间开始回溯，检查日志与主机迹象，有入侵线索就继续按事件响应流程处理。
OpenAI 还提供了 PHP 版本检查 Codex 技能。它可以辅助盘点，但版本检查不能证明没有被入侵，也替代不了发行版回移补丁核对和运行进程验证。
具体配置仍要跟随 PHP 与供应商完整指南。单独抄一个关闭内存限制的参数，漏掉资源隔离和剩余风险条件，也可能制造新的问题。
黑色十月之后，应该怎样评价 AI 安全能力
404 Media 把 PHP2Shell 放进近期一连串安全事件中讨论，用 Black October 描述安全圈的不安。这是对一组事件和行业情绪的概括，不能拿它把所有事故都归因于 AI，更不能把它当作一场统一攻击的名称。
PHP2Shell 给出的证据已经足够具体。AI 辅助研究能让复杂问题更快得到验证，维护者仍要处理修复取舍，披露过程仍可能失序，最后的网站仍要完成部署。
再回头看开头的 update now，我更愿意把它理解成一连串需要有人完成的动作。确认风险、准备更新、找到实例、替换进程，再核验实际结果。
我觉得，评价 AI 安全能力，除了看它发现了多少漏洞，还应该追问，这些发现最终让多少系统及时获得了保护。
下一次紧急公告到来时，团队能不能说清，哪些服务需要更新，怎样证明它们已经修好？这份可核验的结果，才是提前发现能够交给用户的保护。
资料与报告原文
查阅资料与完整报告配图
事件线索参考相关专题汇总，关键事实均对照原始材料核对。主要参考包括 Wiz 研究报告、PHP Foundation 复盘、Calif 研究记录、NSA 官方警告及 404 Media 报道。
下方保留技术细节和完整上下文，供需要进一步核对的读者查阅。PHP、AWS 与 Cloudflare 图片为中文译文，非官方中文版；OpenAI 图片来自官方中文版。所有图均为高清无损 PNG，原文核对日期为 2026 年 10 月 23 日。
PHP 安全公告原文，包括漏洞编号、修复版本、受影响部署及临时措施的限制。
OpenAI 官方中文报告，正文已展示第 1 张，以下依次保留第 2 至第 6 张。
AWS 遥测报告原文，说明披露前活动、观测局限与调查建议。中文译文图见正文。
Cloudflare 防护报告原文，说明 WAF 部署时间、规则覆盖和持续修补要求。中文译文图见正文。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
At the time of the emergency update, the attack had begun.
Open PHP Safety Bulletin, October 21st, 2026, with two words in the title, update now.
Update immediately.
Read further down, two core loopholes may allow unlogged attackers to enforce codes on the server. PHP officially mentions that there are already mod php demonstrations that can trigger an attack before the business code starts running. The log-in check-in and permission check-ups were not carried out at this time.
The person in charge of maintaining the site should first confirm whether the PHP carrying these codes has been repaired. PHP Official Gazette
External requests will not, however, await completion of the update.
According to Cloudflare CEO Matthew Prince, 10 hours before the announcement, the Claudflare network had seen thousands of attempts to use it; it reached tens of thousands in 45 minutes, hundreds of thousands in two hours, and then millions more. 404 Media reports citing his data set.
The use of attempts, including intercepted requests, cannot be accounted for as a number of successful incursions by convert; nor do the observations of Cloudflare represent complete statistics of the entire Internet.
Even so, two hours would be enough to re-think whether security updates could be scheduled slowly or not.
I rechecked the original reports of researchers and defenders. It's not just AI that can find a loophole.
A problem that has existed for many years, why is it now an emergency? The defensive parties are ready in advance, and why does the site still need to compete for minutes when it is publicly disclosed?
A few clues for parallel advancements were put together: researchers found problems, defenders coordinated repairs, external use and public disclosure, not at the same pace.
The time nodes in the figure are organized on the basis of the original materials quoted below, as of 23 October 2026; nodal space does not represent the actual length of time, nor does the rearrangement indicate that the causal link has been established.
PHP2Shell risk, not just the number of holes
PHP2Shell is a combination of CVE-2026-109618 and CVE-2026-109619. The problem is that when PHP is running, incorrect initialized data and released memory continue to be used after memory depletion or fatal errors are involved.
This layer has been modified to only update plugins and change business codes without covering the problem.
According to the Wiz study, the affected version can be traced back to PHP 5.4 and each PHP version of publish in the last decade has been affected by at least one of the problems. The research team also demonstrated how the passwords, tokens and API keys in the process memory can be read without remote code execution. Wiz Research
Therefore, simply looking at whether the server has been ordered to be executed may also leave out the information.
It also needs to be made clear that the PHP is widely used and cannot be written in the same proportion globally. The actual risk also depends on the operational version, the deployment mode, the available path and protection. Researchers demonstrate success and do not mean that all environments have direct access to the same program.
It's the last thing that makes AI's role concrete.
AI changed what, from finding problems to making use of them.
Open AI confirmed that Calif had identified a key loophole in the Patch the Planet using GPT-5.6 Sol, and Wiz had independently identified and reported two. PHP maintainer leads the rehabilitation and publish, with partners providing research, technical support and coordination. Open AI Event Statement
The screenshot was taken from the official Chinese version of Open AI on October 23, 2026.
Wiz made the difficulties in the research process clearer. Complex memory gaps require multiple problems, different PHP versions, configurations and memory layouts, and retest and debug. Wiz stated that the study used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and that the model helped teams to adjust their utilization procedures, analyse failures and repeatedly validate them, reducing the professional input needed to adapt across environments.
It's more interesting than an AI to find holes.
In the past, even if a deficiency existed, complex conditions of utilization could limit its actual impact. This limitation diminishes when analysis, calibration and adaptation become easier. This is Wiz's judgement on this study, and it explains why only the number of holes is not complete.
However, the open use of models by research teams for development and use is still different from the use of AI for every attacker on the Internet. The latter cannot be introduced from the number of requests.
Why the slowness of the repairs and the early disclosure?
PHP Foundation's flash drive fills the background on this side of the maintainer. In the post-audit rehabilitation exercise in 2024, the team had found early signs of OOM problems, but there was no clear remote code implementation path. Several rehabilitation programmes address compatibility, the risk of denial of services and the adequacy of expansion, with constraints on staff and decision-making mechanisms, with work repeatedly stalled. The Foundation recognizes this as a structural failure. PHP Foundation Duplicate
I think this statement is important. It was reasonable to see that serious loopholes had not been fixed for many years; however, a real improvement in response would require knowing whether they were contained in technical trade-offs, decision-making or resources.
Defenders have to face another reality. The patches modify the memory management and error logic through which a large number of requests are made, while maintaining compatibility, performance and ecological expansion. Following the discovery of reliable utilization, there is still work to be done to repair upstream and prepare downstream.
Calif ' s research records listed the starting point for the audit as 30 July and the early discovery as 1 August. More variants were then sought. Calif Research Record
This indicates that early progress is rapid, but it cannot simply be reduced to two days of discovery and two months of writing patches. The identification of impacts, the search for variants, the validation of repairs and coordinated distribution are at different stages.
Before publish, the coordination process was disrupted.
According to PHP Foundation, the CVE number was circulated early on 20 October, with the wrong 10.0 rating, actually 9.2. PHP advanced publish from 22 to 21 days; the issuer is packing, and the immediate release will leave many users without easy access to new paths. This was followed by the misdispatch of the presentation video, which added public information.
One day in advance, is the compromise between speed and renewal of availability. The more people need to be informed in advance in order to be prepared for protection, the more difficult confidentiality coordination is.
Early detection and pre-disclosure use, which can occur simultaneously
The MadPot telemetry record of AWS shows that PHP2Shell made an attempt four days earlier than public disclosure on October 17. Source IP is linked to a commercial anonymous network; AWS believes that it may be from a threatening actor, but it is not clear how the other party can access the information. AWS Telemetry Note
Chinese translation, unofficial Chinese version. According to the AWS official translation above, the date of the original check is 23 October 2026.
Open AI claims that, as far as it is known, Frontline AI discovered holes earlier than the attackers. This does not necessarily conflict with AWS records.
A comparative study found a sequence of activities that had appeared prior to the public disclosure of a record, followed by those found by the attackers. The researchers knew the problem in advance and did not guarantee that no one would find it throughout the confidentiality period.
There's still a relationship that can't be reversed. The exploitation attempt on October 17, predates the public disclosure of PHP Foundation 20 days. Subsequent leaks could not directly explain earlier requests; whether there was any other flow of information or independent discovery, which could not be concluded at this time.
So the best thing to change in those four days is the starting point of the investigation.
Once the patch is installed, the old log still has to be checked. Requests may have been on the server long ago, and abnormal files, strange processes and undesired connections will not automatically disappear with the version numbers.
Early protection takes time, not a substitute for actual repair.
Advance preparation is certainly valuable. Claudflare states that the relevant WAF protections were prepared at the beginning of October and were commissioned by default to customers using free or paid WAF at 02 0200 UTC 03, Beijing time on 21 October. Cloudflare protection report
Chinese translation, unofficial Chinese version. According to an official translation of Cloudflare above, the date of the original check is 23 October 2026.
The source station has not been upgraded, and the traffic entrance has been secured, which is where the gained time can work in advance.
But the main domain name is gone. WAF, can the source access it? Is the background domain and test environment also protected at the same level? Interceptions at one entry point cannot be secured for other entry points.
An official NSA warning has made disposal requirements more straightforward by taking stock of PHP-dependent services and applying patches as soon as possible; if not updated immediately, it is recommended to go offline until the risk can be adequately mitigated. NSA Official Warning
The offline is a measure to reduce exposure and cannot be used as evidence that the service has been breached.
Claudflare and AWS also continue to request an update of PHP. WAF is an additional protection, complete repair needs to be in operation. AWS Mitigation Guidelines
Next time we get an update, how do we know the system is fixed?
As at 23 October 2026, the PHP bulletins for this restoration were 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Users of the old branch need to confirm the supplier ' s back move patch or move to a supported version. In the case of return removal repairs, safety cannot be determined by the upstream version alone.
At command line, php-v, the only binary that was found was that command. Whether PHP-FPM, mod php, which is the real recipient of the request, has loaded the restored version is still to be confirmed. The mirror was updated, all copies were replaced; the package was installed, the worker was not restarted, and the results were actual.
To me, three things are the best thing to do.
The case of the impact is tracked, and the person responsible, the software package or the mirror summary is matched.
Check the coverage of all accessible access points, confirm that the service process has been updated and that critical operations remain operational.
From the earliest known time of use, logs and mainframe signs are checked, and intrusion leads continue to be processed as incident response processes.
Open AI also provided PHP version examination Codex skills. It supports the inventory, but the version check does not prove that it was not invaded, nor is it a substitute for the release back-to-back patch check and running process validation.
The specific configuration still follows PHP and complete guidance to suppliers. A separate copy of the parameters for closing the memory limit, missing resource segregation and residual risk conditions, could also create new problems.
How do we evaluate AI security after October?
Media put PHP2Shell in a series of recent security incidents to describe the security circle's unease with Black October. This is an overview of a set of events and industry emotions that cannot be attributed to AI, let alone used as the name of a unified attack.
PHP2Shell has given evidence that is sufficiently specific. AI Auxiliary research allows for more rapid validation of complex issues, maintenance still has to deal with repair trade-offs, the disclosure process may still be out of order and the final website remains to be deployed.
And looking back at the beginning, I'd rather see it as a series of actions that need to be done. Identification of risks, preparation for updates, identification of examples, replacement process and re-checking of actual results.
In my view, the evaluation of AI's security capabilities, in addition to seeing how many gaps it has found, should be asked how many systems it has ultimately secured in a timely manner.
When the next emergency announcement came, could the team clarify which services needed to be updated and how to prove that they had been repaired? This verifiable result is the early discovery of protection that can be given to the user.
Information and original text of the report
Access to information and complete report mix
Incident leads are summarized by reference to relevant topics, and key facts are checked against the original material. The main references include the Wiz study, the PHP Foundation Repository, the Calif Research Record, the NSA Official Warning and the 404 Media Report.
Technical details and complete context are kept below for further cross-checking of readers. Photos of PHP, AWS and Cloudflare are translated into Chinese and are not official Chinese; photos of Open AI are from the official Chinese version. All the maps are high-resolution PNG and the original reconciliation date is 23 October 2026.
PHP Security Bulletin in its original language, including gap number, repair version, affected deployment and temporary measures restrictions.
Open AI's official Chinese report, the first is displayed in the body and the second to the sixth is retained below.
AWS telemetry report text describing pre-disclosure activities, observation limitations and survey recommendations. For the Chinese translation, see the main text.
The original version of the Cloudflare protection report indicates the WAF deployment time, rules coverage and ongoing repair requirements. For the Chinese translation, see the main text.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.