什麼是 PHP？為什麼政府和企業網站會紛紛下線？ （1/2）

Recently The New York Times reported the following:

What Is PHP? Why Are Government and Business Websites Going Offline? (1/2)

A critical security flaw in the programming language underpinning much of the web has prompted a global rush to patch vulnerable systems.

By Karla Adam and Dustin Volz (Aaron Krolik contributed reporting)

Oct. 22, 2026

Governments and companies around the world are racing to patch their websites — or taking them offline until they can be fixed — after the discovery of major security flaws in PHP, a piece of software that underpins much of the internet.

OpenAI, whose artificial intelligence models were used to find the bugs, said in a blog post that it was “one of the most impactful security issues in recent memory” given PHP’s widespread use.

While many websites were taken down as a protective measure, as of Thursday afternoon there had not been any confirmed successful attacks using the PHP flaws, according to an analysis by Dataminr, a risk-intelligence cybersecurity company.

“Observed activity since vulnerability disclosure remains limited to scanning, fingerprinting and use of non-working exploits, with no known compromises,” Dataminr said, though it added it was “only a matter of time” before successful intrusions would occur.

What is PHP?

PHP, short for PHP: Hypertext Preprocessor, is a decades-old, open-source programming language that is used to build and run web applications. By some estimates, about 70 percent of all websites and web applications use the software.

Services in which PHP is a core ingredient include content management systems like WordPress and Drupal, which help people run websites. Because PHP is a sort of foundational code baked into so many platforms — think of it as invisible digital infrastructure — many businesses may not even realize they rely on PHP.

How was the flaw discovered?

Security researchers discovered issues in the programming language that could be exploited by an outside attacker.

The bug, which has been hidden in the software for years, was identified by researchers at Calif, a small, U.S.-based cybersecurity company, using OpenAI’s GPT-5.6 Sol model. Researchers from Wiz, an Israeli-American security firm owned by Google, also independently reported the vulnerabilities.

The flaw is the latest to be discovered using advanced A.I. tools, which cybersecurity experts have warned are dangerously effective at finding bugs and weaponizing them. In its blog post, OpenAI said that the discovery of the PHP vulnerability highlighted “how A.I. can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”

The company added that, as far as it was aware, “frontier A.I. found these vulnerabilities before attackers did.”

What are the risks?

Given that PHP powers much of the web, security professionals are concerned that hackers could move quickly against unpatched systems, manipulating how they operate and stealing the private data they contain. Experts also cautioned that because the technical details are now public, malicious actors can reverse-engineer a patch to rapidly increase their attempts exploit the vulnerability.

That creates an unusually urgent race to update systems. While A.I. models can help spot vulnerabilities, it can also be used to target many victims at once.

The PHP disclosure was further complicated by a leak before the patch. On Tuesday, details of the bugs were mentioned in a post on a hacker forum, which prompted the nonprofit foundation that oversees the software to release a fix a day earlier than planned.

(to be continued)

Translation

什麼是 PHP？為什麼政府和企業網站會紛紛下線？ （1/2）

支撐大部分網路功能的程式語言 PHP 存在一個嚴重的安全漏洞，引發了全球修復漏洞系統的緊急行動。

在發現 PHP -  一種支撐大部分網路功能的軟件 - 存在重大安全漏洞後，世界各地的政府和企業都在爭分奪秒地修復網站漏洞，或者暫時下線直至修復完成。

OpenAI 的人工智能模型被用來發現這些漏洞。該公司在一篇部落格文章中表示，鑑於 PHP 的廣泛應用，這是「近年來最具影響力的安全問題之一」。

雖然許多網站出於保護目的而暫時關閉，但根據風險情報網路安全公司 Dataminr 的分析，截至週四下午，尚未有任何利用 PHP 漏洞成功發動的攻擊得到證實。

Dataminr 表示：「自漏洞披露以來，觀察到的活動仍然僅限於掃描、指紋識別和使用無效的漏洞，目前尚未發現任何安全漏洞」。不過，該公司也補充說，成功入侵「只是時間問題」。

什麼是 PHP？

PHP，全稱 PHP: Hypertext Preprocessor（超文本預處理器），是一種已有數十年歷史的開源程式語言，用於建置和運行 Web 應用程式。據估計，大約 70% 的網站和 Web 應用程式都使用了這種軟件。

以 PHP 為核心的服務包括 WordPress 和 Drupal 等內容管理系統，這些系統可協助使用者運行網站。由於 PHP 是一種嵌入到眾多平台的基礎程式碼 - 可以將其視為一種隱形的數位基礎設施 - 許多企業甚至可能沒有意識到他們依賴 PHP。

該漏洞是如何被發現的？

安全研究人員發現了該程式語言中有問題可能被外部攻擊者利用。

這個漏洞已在軟件中隱藏多年，由美國小型網路安全公司Calif的研究人員使用OpenAI的GPT-5.6 Sol模型發現。谷歌旗下的以色列-美國安全公司Wiz的研究人員也獨立報告了這個漏洞。

該漏洞是近期利用先進人工智能工具發現的最新漏洞。網絡安全專家警告稱，這些工具在發現漏洞和將其武器化方面極其有效。 OpenAI在其部落格文章中表示，PHP漏洞的發現凸顯了「人工智能如何能夠發現具有達網路規模影響的安全漏洞，但同樣的能力也可能幫助攻擊者快速開發攻擊工具和利用漏洞」。

該公司補充說，據其所知，「前沿人工智能比攻擊者較先發現了這些漏洞」。

風險是什麼？

鑑於PHP驅動大部分網絡應用，安全專家擔心駭客可能會迅速攻擊未修補系統，操縱其運作方式並竊取其中包含的私人資料。專家還警告說，由於技術細節現已公開，惡意攻擊者可以對修補程式進行逆向工程，從而迅速增加利用漏洞的嘗試次數。

這導致競爭系統更新異常激烈。雖然人工智能模型可以幫助發現漏洞，但它也可能即刻被用攻擊多個受害者。

PHP漏洞的洩漏事件在修補程式發佈前就已發生，這使得情況更加複雜。週二，駭客論壇上的一篇貼文提到了這些漏洞的細節，促使負責管理該軟件的非牟利基金會提前一天發佈了修復程式。

（待續）