PHP 曝出两个漏洞波及大量网站，DeviantArt、4Chan 一度关停
PHP: The three little letters wreaking havoc across the web
- 1PHP 曝出两个漏洞，据称最多 70% 的网站以某种方式使用 PHP，波及全球互联网
- 2漏洞存在于近 20 年来所有 PHP 版本中，许多已不再受支持，失修网站可能被迫永久关停
- 3DeviantArt、4Chan 在漏洞披露后一度关停，Internet Archive 亦短暂下线
- 4文中提到 GPT-5.6 Sol 被用于发现该关键漏洞，安全公司 Wiz 称其为软件史上最严重漏洞之一
这是语言层面的系统性缺陷，一次补丁救不回所有站点，长期失修的旧系统可能只剩关停一条路。
- 影响：使用 PHP 的业务要重估线上服务连续性，头部平台也可能短时下线；长期失修的旧站点修复选项有限，可能只能关停；修复要跨约 20 年的版本升级，成本远超一次打补丁。
- 参考：可考虑先盘点自有及供应商系统中的 PHP 版本，标出已停止支持的实例；值得为仍在运营的旧站点排出升级与关停的取舍，并把 PHP 版本支持情况列入供应商安全评估清单。
- 依据：70% 使用率为文中转述的估算；各站点关停下线为公开报道；最严重漏洞之一的评价出自安全公司 Wiz，GPT-5.6 Sol 的作用为文中转述。
Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.
By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.
But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.
Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”
- The disastrous PHP vulnerabilities were exploited days before the patch
- The Internet Archive was briefly forced offline because of PHP.
- Two old-school Japanese mobile games are shutting down over the PHP exploit.
- The PHP2Shell exploit hit Cloudflare hard.
- PHP: The three letters that shut down sites all over the internet today
- GPT‑5.6 Sol was used to identify critical PHP flaw.
- A critical PHP vulnerability may take websites down today
来源：The Verge · AI · theverge.com