广泛使用的 PHP 编程语言的开发者周三敦促用户立即安装安全更新，此前发现了两个严重漏洞，可能允许远程代码执行，引发了对全球网站和服务器安全性的担忧。
Developers of the widely used PHP programming language urged users to install security updates immediately on Wednesday after two critical vulnerabilities were found that could allow remote code execution, raising concerns about the security of websites and servers worldwide.
开发者发布了该程序的修补版本，并警告称攻击者无需身份验证即可利用这些缺陷。
The developers released patched versions of the program and warned that attackers could exploit the flaws without authentication.
PHP 团队在一份安全公告中表示，所有处理 Web 请求的安装都可能面临风险。
In a security advisory, the PHP team said all installations handling web requests were potentially at risk.
开发者将这两个漏洞标识为 CVE-2026-109618 和 CVE-2026-109619。这些缺陷涉及内存处理错误以及可在请求之间持久存在的过时内部状态，可能允许攻击者在受影响的服务器上执行恶意代码。
The developers identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. The flaws involve memory-handling errors and outdated internal state that can persist between requests, potentially allowing attackers to execute malicious code on affected servers.
美国国家安全局（NSA）也要求使用 PHP 的组织做好立即更新的准备，警告称这些漏洞可能让攻击者直接访问服务器文件系统或数据库。
The US National Security Agency (NSA) also asked organizations using PHP to prepare for an immediate update, warning that the vulnerabilities could provide attackers with direct access to server file systems or databases.
该机构表示：“这些漏洞通常为攻击者提供通往服务器文件系统或数据库的直接路径。如果无法立即更新，建议组织将系统下线，直到能够完全缓解风险。”并补充称将随后提供更详细的指导。
“These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated,” according to the agency, adding that more detailed guidance would follow.
联邦调查局（FBI）网络部门敦促组织立即更新受影响的 PHP 安装并清点运行 PHP 的系统，优先处理面向互联网的服务器和包含该编程语言的第三方产品。该局还呼吁监控 Web 服务器的可疑活动，包括 PHP 进程意外启动命令 Shell 或下载文件，以帮助识别潜在的利用行为。
The FBI Cyber Division urged organizations to immediately update affected PHP installations and inventory systems running PHP, prioritizing internet-facing servers and third-party products that include the programming language The bureau also called for monitoring web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files, to help identify potential exploitation.
OpenAI 在一份声明中表示，其模型通过“修补星球”计划帮助研究人员发现了这些缺陷，该计划汇聚了软件维护者、研究人员和安全提供商，在公开披露前开发了修复方案。
OpenAI said in a statement that its models helped researchers discover the flaws through its Patch the Planet initiative, which brought together software maintainers, researchers and security providers to develop fixes before public disclosure.
该公司表示，准备过程耗时两个月，因为修复这些漏洞需要对 PHP 引擎进行复杂的更改。
The company said the preparation process took two months because addressing the vulnerabilities required a complex change to the PHP engine.
据 OpenAI 估计，PHP 用于互联网的很大一部分，为约 70% 的网站提供支持。其规模意味着未修补的系统可能为攻击者创造重大机会。
PHP is used in a substantial share of the internet, with OpenAI estimating that it powers around 70% of websites. Its scale means unpatched systems could create significant opportunities for attackers.