十多年来，支撑互联网运行的许多技术中存在严重漏洞，但这些漏洞一直未被发现。直到人工智能（AI）的出现，这些问题才被曝光，从而引发了全球范围内的网络安全警报。
For more than a decade, serious flaws had gone undetected in technology underpinning much of the internet. It took artificial intelligence (AI) to bring them to light and caused a global cyber-security alert.
这些漏洞存在于一种名为 PHP 的编程语言中。自 21 世纪以来，PHP 一直被广泛用于构建网站。周三，世界各国政府和网络安全机构纷纷采取措施来控制这一漏洞带来的影响，并敦促网站运营商立即安装新的安全补丁，或考虑暂时关闭其网站平台。
The vulnerabilities lie within a programming language called PHP, which has been used internationally since the 2000s to build websites. Governments and cyber-security agencies around the world scrambled to contain the fallout of this discovery on Wednesday, and have urged website operators to install a new emergency fix or consider taking their platforms offline.
发现这些漏洞的公司之一——Wiz 的研究人员将这些漏洞描述为“AI 所检测到过的最严重的安全漏洞”。另外一家使用 AI 技术进行漏洞检测的公司 OpenAI 则称这一发现是“近年来最具影响力的网络安全事件之一”。
Cyber-security firm Wiz - one of the companies whose researchers uncovered the vulnerabilities - described the flaws as the "most severe" ever detected by AI. OpenAI, whose technology was used to find the flaws, called the discovery "one of the most impactful security issues in recent memory".
虽然大多数人可能从未听说过 PHP（全称为 PHP: Hypertext Preprocessor），但他们每天都在与 PHP 所支持的网站进行交互。PHP 是许多网站（包括在线商店、维基百科以及 WordPress 等内容管理系统）的核心技术。Gorilla Cyber Security 公司的首席执行官 Paul Spain 向 BBC 解释说：“当你访问维基百科等网站时，正是 PHP 负责收集所需信息，并将其以可视化的形式呈现给用户。”
Most people may not have heard of PHP - short for PHP: Hypertext Preprocessor - but they most certainly interact with it daily. PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress – the content management system behind many websites like blogs. When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC.
然而，由于存在某些安全漏洞，攻击者可以在未经身份验证的情况下控制受影响的网站服务器并窃取敏感数据。Paul Spain 表示，这些漏洞使得网络攻击变得更加容易和迅速；他估计，受影响的网站数量可能多达“数百万个”。Adelaide 大学的网络安全研究员 Jill Slay 指出，如果黑客或某些国家将这一漏洞用于恶意目的并窃取网站上的私人数据，后果将极其严重。
But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed. AI could make such attacks easier and faster, Spain said, estimating that the flaw could affect "millions and millions" of websites. It would be "disastrous" if hackers or countries weaponised the flaw and seized private data from websites, said cyber-security researcher Jill Slay from the University of Adelaide.
此次网络安全警报已经导致全球范围内的服务中断，涉及游戏平台、政府门户网站以及各种在线论坛。
The alert has disrupted services globally, from gaming platforms to government portals and online forums.
其中包括维基媒体——在线百科全书维基百科背后的组织——该组织出于预防措施关闭了部分系统。
That includes Wikimedia - the organisation behind the online encyclopaedia Wikipedia - which took down a number of its systems as a precautionary measure.
芬兰政府、爱丁堡市议会和BBC已将部分网站和页面下线，荷兰网络安全机构也撤下了其网站。
Sites and pages have been taken offline by the Finnish government, Edinburgh council and the BBC, with the Netherlands' cyber-security agency also pulling its website.
苏格兰的多个公共机构，包括议会和卫生委员会，也已将各自的网站下线。
A number of Scotland's public organisations, including councils and health boards, have also taken their websites offline.
一些专家警告说，这一漏洞可能使维护不善的网站面临更大风险，尤其是那些安全资源有限的小型组织的网站。
Some experts warn the vulnerability could leave poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, at greater risk.
新南威尔士大学悉尼分校的网络安全研究员萨利尔·卡内雷表示，由于技术细节现已公开，未来几周内可能会出现更多利用这些漏洞的尝试。
More attempts to exploit these flaws are likely in the coming weeks since the technical details are now being made public, cyber-security researcher Salil Kanhere from UNSW Sydney said.
PHP平台的开发者周三发布了补丁，以修复多年来潜伏在其软件中的这些漏洞。该公司表示：“我们强烈建议所有PHP用户立即更新。”
Developers of the PHP platform on Wednesday rolled out patches to fix the vulnerabilities that had been lurking in their software for years. "All PHP users are strongly encouraged to update immediately," the company said.
世界各地的主管部门和安全机构也向网站运营者发出了同样的警告，要求他们保护好自己的平台。
Authorities and security organisations around the world have echoed those warnings to website operators to secure their platforms.
美国国家安全局告知所有使用PHP的组织，如果无法立即打补丁，就应将系统下线，并补充说该漏洞可能提供一条“直接路径”来利用系统的数据库。
The US National Security Agency told all organisations that use PHP to take their systems offline if they were unable to patch them immediately, adding that the flaw could provide a "direct path" to exploit a system's database.
该机构表示：“这些风险足够严重，需要美国政府部门和机构立即打补丁。”
"These risks are serious enough to require immediate patching across United States Government departments and agencies," the agency said.
英国国家网络安全中心给出了类似建议，并告诉各组织检查是否存在“攻击者安装的后门”。欧盟和澳大利亚的相应机构也发布了类似警报。日本首相高市早苗敦促人们检查其公开网站是否运行在PHP上。
The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker". Its counterparts in the EU and Australia have also issued similar alerts. Japanese Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP.
“我们紧急请求所有人今晚采取行动，”高市早苗在X上写道。“如果难以及时应用修补补丁，暂时暂停网站等措施可被视为降低风险的有效方式，”她说。
"We have an urgent request for everyone to take action tonight," Takaichi wrote on "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," she said.
这些漏洞是由安全公司Calif和Wiz的网络安全研究人员发现的。
The vulnerabilities were found by cyber-security researchers at the security firms Calif and Wiz.
研究人员使用了先进的AI工具，这些工具能够分析代码并发现缺陷，速度远快于人类或旧系统。
The researchers used advanced AI tools that are able to analyse code and find flaws much faster than humans or older systems can.
“现代软件极其复杂，一些漏洞可能多年未被发现，”Kanhere说。
"Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," Kanhere said.
“底层的缺陷并非新出现；变化的是我们发现它们的能力，”Kanhere说。
"The underlying bugs weren't new; what changed was our ability to find them," Kanhere said.
发现细节本周泄露到网上，迫使PHP平台的开发者匆忙发布了关于该安全漏洞及其巨大规模的公告。
Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale.
OpenAI在一篇博客文章中表示，这一事件“凸显了AI如何能发现安全漏洞”，但也展示了它如何能“帮助攻击者快速开发进攻性工具和漏洞利用代码”。
The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post.
ChatGPT的制造商表示，它已发布一个程序，用于检查PHP平台是否安全。
The ChatGPT-maker said it had released a program to check if the PHP platform is secure.
“许多此类缺陷源于过去软件的构建方式，那些软件是为功能而构建，并未将安全放在心上，”昆士兰大学网络研究中心的Ryan Ko说。网站所有者被敦促使用最新版本的PHP来保护其网站。
"Many of these flaws stem from the way software were built in the past, which were built for functionality and not with security in mind," said Ryan Ko, at the University of Queensland's Cyber Research Centre. Website owners are being urged to secure their websites with the latest version of PHP.
美国国家安全局已敦促在未来几周保持“高度警惕”，并密切关注软件供应商的更新。它说：“及时应用与这些系统相关的补丁至关重要。”
The US National Security Agency has urged "heightened awareness" in the coming weeks and to closely monitor updates from software vendors. "Vigilance in applying patches related to those systems is paramount," it said.
Kanhere说，责任主要在于网站运营商，但用户应保持警惕，留意受影响服务发布的任何安全建议，例如要求更改密码的请求。他警告人们要警惕任何利用该事件关注度进行的网络钓鱼信息。
The onus lies mainly on website operators, but users should stay alert for any security advice issued by affected services, such as requests to change passwords, Kanhere said. He warned people to be alert to any phishing messages exploiting the publicity around the incident too.