2026年10月21日，PHP官方公开披露了两个评分高达9.2分（满分10分）的严重安全漏洞，编号分别为CVE-2026-109618和CVE-2026-109619。这些漏洞存在于支撑全球约70%网站的PHP编程语言中，影响范围涵盖PHP 5.4及之后的主流版本，具备导致远程代码执行的风险 1。
此次漏洞的发现得益于OpenAI推动的“Patch the Planet”项目框架。自2026年6月启动以来，该项目已在19个开源项目中识别出数百个安全问题 1。安全公司Calif和Wiz利用GPT-5.6 Sol、Gemini 4 Argon等人工智能工具，成功定位了这些潜伏十余年的隐患，为全球系统管理员争取到了宝贵的修复时间窗口 1。
针对这一突发安全威胁，美国国家安全局（NSA）警告称，无法立即更新系统的组织应考虑将相关设备离线以规避风险 1。与此同时，中国国家信息安全漏洞共享平台（NVDB）也建议用户立即排查受影响系统，尽快升级至最新版本或采取临时防护措施 1。
Security researchers, leveraging advanced artificial intelligence tools, uncovered two critical vulnerabilities in the PHP programming language that had remained undetected for over a decade. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026 1. These vulnerabilities carry a high severity score of 9.2 out of 10 due to their potential to enable remote code execution 1.
The discovery was made by security firms Calif and Wiz using AI models including GPT-5.6 Sol and Gemini 4 Argon 1. Their work falls under the "Patch the Planet" initiative, an OpenAI-led project launched in June 2026 that has already identified hundreds of security issues across 19 open-source projects 1. The affected PHP versions include 5.4 and all subsequent mainstream releases, which support approximately 70% of websites globally 1. This find provides system administrators worldwide with a crucial window of time to implement patches before exploitation occurs 1.
Authorities have issued urgent warnings regarding the severity of these findings. The National Security Agency (NSA) advised organizations unable to immediately apply updates to take their systems offline 1. Similarly, China’s National Vulnerability Database (NVDB) recommended immediate inspection and upgrading to the latest version or applying temporary protective measures 1.
评论
还没有评论，欢迎留下第一条。