研究人员用 GPT-5.6 Sol 发现 PHP 两个 CVSS 9.2 严重漏洞
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as oper...
AI 摘要
AI 安全公司 Calif 用 GPT-5.6 Sol 在 PHP 中发现两个 CVSS 9.2 严重漏洞，可让无账号攻击者接管 Web 服务器，影响远至 PHP 5.4 的版本，PHP 提前一天紧急发布修复。
正文 · AI 翻译
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as operators rushed to patch.
Calif, an AI security firm, who found this, said in a statement that the vulnerabilities could put 70% of the world’s websites at risk if they aren’t patched quickly, and called them “the most severe vulnerabilities ever discovered by AI, if not in all of software history.”
> PHP rushed out fixes as it could let attackers without accounts take over web servers.
> Both bugs score 9.2 on the CVSS severity scale and affect PHP versions as old as 5.4.
> When a request hits PHP’s memory cap at the wrong moment, PHP frees memory but keeps pointers to it, which a later request on that worker can hijack.
> Auditors spotted the weakness in 2024, but the fix stalled for months, partly because nobody had shown a practical attack.
> Wiz, a cloud security company, now owned by Google, says the models let one researcher finish in a week what once took a top team months.
> A leak of the CVE numbers forced PHP to ship a day early, and Cloudflare now reports early attack attempts.
原文
Original Title
Researchers using GPT-5.6 Sol found massively critical flaw in PHP, which runs about 70% of websites, knocked major sites offline as oper...
Source
Rohan Paul
Site
x.com
Published
2026-10-21T17:40:59.000Z