OpenAI 的 GPT-5.6 Sol 与 Google 的 Gemini 4 Argon 发现影响数百万网站的 PHP 关键漏洞
OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites
- 1OpenAI 与 Google 的模型发现影响全球数百万网站的 PHP 关键漏洞，OpenAI 称早于攻击者曝光
- 2安全公司 Wiz 独立发现同样漏洞，称 Gemini 4 Argon 在找漏洞、开发攻击利用和验证补丁上尤其有用
- 3Wiz 指出大模型可自动改写攻击代码适配不同 PHP 版本、配置和内存布局，显著降低攻击规模化门槛
- 4OpenAI 预计此类规模的漏洞发现未来数月将急剧增加，并警告同样的能力也会帮助攻击者
前沿模型跑通了从漏洞发现、利用开发到补丁验证的完整安全流程，同一能力同时降低攻防两端的门槛。
- 影响：运行 PHP 的网站存在明确暴露面，官方提供 GitHub 检测工具和补丁，响应窗口攻防共享；Wiz 指出大模型能自动改写利用代码适配不同环境，过去难利用的漏洞可能变成可行目标；OpenAI 预计此类发现激增，安全团队的排查与响应压力会随之上升。
- 参考：可考虑先用 GitHub 上的检测工具核对本组织 PHP 版本是否受影响并排期补丁；值得评估让安全团队在漏洞挖掘、检测规则验证等环节引入模型的试点场景；可把攻击代码易被 AI 改写纳入漏洞风险评估的维度。
- 依据：OpenAI 称此漏洞属 Patch-the-Planet 项目成果，并称其为近年影响最大的安全问题之一，系官方口径；Wiz 以自家平台搭配两个模型独立复现同一漏洞，攻击门槛下降的判断出自其分析。
AI models from OpenAI and Google found a critical PHP vulnerability that could affect millions of websites worldwide.
GPT-5.6 Sol tracked down the flaw as part of the Patch-the-Planet initiative, which OpenAI calls one of the "most impactful security issues in recent memory." The model spotted the vulnerabilities before attackers did, giving developers and security vendors a window to respond. A tool on GitHub now lets server operators check whether their PHP version is affected.
Security firm Wiz found the same flaws independently, using its own Wiz Atlas platform alongside Google's Gemini 4 Argon and GPT-5.6 Sol. Gemini 4 Argon proved especially useful for finding the vulnerability, developing exploits, building attack detection, and validating the patch, according to Wiz.
AI lowers the bar for attackers
An exploit that worked against one specific PHP installation used to require significant effort to adapt to other versions and configurations, Wiz explains. Large language models remove that barrier because they can automatically adjust exploits across different PHP versions, configurations, and memory layouts. "This significantly lowers the barrier to scaling attacks across different deployments," the firm writes, adding that "vulnerabilities that once seemed impractical to exploit become viable targets."
The fix was coordinated over two months across five phases, involving PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House. OpenAI is proposing this process as a repeatable framework for future AI-driven security discoveries.
The company expects findings on the scale of the PHP2Shell flaw to "increase sharply in the coming months," but warns that the same AI capabilities that find vulnerabilities can help attackers too. The discovery feeds into a months-long debate over AI models' offensive and defensive cybersecurity capabilities.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
来源：The Decoder：AI News · the-decoder.com