AI-Assisted Discovery of PHP2Shell Vulnerabilities Followed by Mass Exploitation Attempts
On October 21, two remote-code-execution vulnerabilities in PHP, each scored 9.2 under CVSS, were disclosed. Both allowed unauthenticated attackers to execute arbitrary code. The report says researchers from Wiz, Calif, and OpenAI used AI to find the flaws. Chainguard’s CEO separately said the company’s AI Harness and a frontier model discovered the same class of memory-corruption vulnerabilities. The PHP project moved up its patch release by one day, while government and public-sector agencies took protective measures. Cloudflare CEO Matthew Prince said the company observed thousands of exploitation attempts in the 10 hours before public disclosure, tens of thousands within 45 minutes afterward, and hundreds of thousands within two hours.
The vulnerabilities enabled unauthenticated code execution in widely used PHP infrastructure, while AI-assisted discovery was followed by rapidly increasing exploitation attempts. The early disclosure of vulnerability information and accelerated patch release compressed the time available to administrators, prompting emergency warnings and protective measures.
10 月 21 日，全球约七成网站依赖的编程语言 PHP 被曝出两个 CVSS 评分 9.2 的远程代码执行漏洞。各国政府网站下线、医院和学校紧急维护、Cloudflare 在两小时内观测到数十万次攻击尝试。而在补丁得以被数百万台服务器安装之前，一个住在捷克的志愿者，做了最关键的那一步。
被提前引爆的危机，埋在结构性失败之上
过去一个月，网络安全专家的公开发言里透着一种少见的恐慌。有人警告，AI 可能引爆一场“黑天鹅”事件；有人被近期集中冒出来的一大批漏洞震住了；还有人担心，Agent 和大语言模型正在展现出发现并利用未知漏洞的能力。
这些声音，轻一点的，是老生常谈的安全建议——及时更新软件、开启双重验证；重一点的，则在网上含糊地谈论 AI 驱动的攻击，感叹“互联网曾经很美好”，甚至流露出末日求生式的恐慌："劝人从银行取出现金、断开网络、囤积耐储存的食品和饮用水、把钱换成黄金和现金，再买一台手摇应急收音机。
#PHP#PHP Foundation#PHP2Shell#Wiz#Calif#OpenAI#Chainguard#Chainguard AI Harness#Cloudflare#Ondřej Surý#Internet Systems Consortium