Wiz Research利用先进AI模型在PHP核心引擎中发现了一系列关键漏洞（PHP2Shell），这些漏洞影响PHP 5.4及之后发布的几乎所有版本1。这些内存安全漏洞可导致未认证的远程代码执行和内存数据泄露，最严重漏洞的CVSS评分达到9.21。由于PHP驱动全球约70%的网站，包括WordPress、Drupal、Joomla和Wikipedia的MediaWiki等广泛应用，此次发现影响范围极为广泛1。
Wiz Research使用Gemini 4 Argon和GPT-5.6 Sol等AI模型完成了漏洞的发现和利用开发1。这些漏洞隐藏超过十年未被发现，于2026年8月19日被识别1。PHP团队与安全研究人员进行了协调披露，并于2026年10月21日同步发布了补丁和公开漏洞详情1。
Wiz Research has identified multiple severe vulnerabilities in the PHP core engine using advanced artificial intelligence models, collectively known as PHP2Shell.1 The vulnerabilities affect virtually every PHP version released since version 5.4, with each iteration impacted by at least one flaw.1 These memory safety issues enable unauthenticated remote code execution and memory data leakage, posing a significant threat to the approximately 70 percent of websites worldwide that rely on PHP.1
The security flaws were discovered on August 19, 2026, after remaining undetected for over a decade.1 The PHP development team released patches on October 21, 2026, coordinating disclosure efforts on the same date.1 The most critical vulnerabilities carry a CVSS severity rating of 9.2.1 Major PHP-based platforms including WordPress, Drupal, Joomla, and Wikipedia's MediaWiki are among the affected applications.1 Wiz Research employed cutting-edge AI models, specifically Gemini 4 Argon and GPT-5.6 Sol, to both identify the vulnerabilities and develop proof-of-concept exploits.1
评论
还没有评论，欢迎留下第一条。