香港信息安全监察机构周四上午就一种广泛使用的网页编程语言中的两个关键漏洞发布了“极高风险”警告，这些漏洞可能让黑客远程执行代码并控制服务器。
A Hong Kong information security watchdog issued an “extremely high risk” warning on Thursday morning over two critical flaws in a widely used web programming language that could allow hackers to execute code remotely and take control of servers.
此前，海外政府和网络安全机构已发布类似警报，敦促网站运营者安装更新以修复 PHP 编程语言中的漏洞。
The warning followed similar alerts from governments and cybersecurity agencies overseas, which urged website operators to install updates to fix the vulnerabilities in the PHP programming language.
香港电脑保安事故协调中心（HKCERT）表示，远程攻击者可利用这些漏洞在目标系统上执行代码。该政府资助机构建议组织立即安装补丁。
The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) said a remote attacker could exploit the vulnerabilities to execute code on a targeted system. The government-funded group advised organisations to install the patches immediately.
香港电脑保安事故协调中心在其网站上表示：“若无法立即修补，组织应考虑将面向互联网的应用程序与公共网络隔离，直至安全修复程序应用并经验证。”
“If immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until the security fixes are applied and verified,” HKCERT said on its website.
《南华早报》已联络香港政府数字政策办公室，询问当局是否已采取相应行动。
The South China Morning Post has contacted the Hong Kong government’s Digital Policy Office to ask whether authorities have taken corresponding action.
OpenAI 周三在 X 平台发帖称，其人工智能模型帮助研究人员发现了这些 PHP 漏洞。
OpenAI said in a post on X on Wednesday that its artificial intelligence models had helped researchers discover the PHP flaws.
PHP 开发团队敦促用户立即更新编程语言，以修复这两个关键漏洞，每个漏洞的严重程度评级均为 10 分中的 9.2 分。
The PHP development team urged users to update the programming language immediately to fix the two critical vulnerabilities, each given a severity rating of 9.2 out of 10.
香港资讯科技联会荣誉会长方保侨表示，全球使用最广泛的内容管理系统 WordPress 严重依赖 PHP，各类电商和企业门户网站也是如此。他说，这些漏洞可能影响公众常用的热门网站。
Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said WordPress, the world’s most widely used content management system, relied heavily on PHP, as did various e-commerce and enterprise portals. He said the flaws could affect popular websites used by the public.
方保侨解释说，当用户点击按钮、填写表单或登录账户时，服务器上运行的 PHP 会处理数据、连接数据库并实时生成网页内容。他敦促网站管理员立即安装补丁。
Fong explained that when a user clicked a button, filled in a form or logged into an account, PHP running on the server processed the data, connected to databases and generated webpage content in real time. He urged website administrators to install the patches immediately.
“如果被利用，黑客可以直接控制服务器，对企业和个人网站构成严重的安全威胁，”他说。
“If exploited, hackers can gain direct control of servers, posing a severe security threat to both enterprise and personal websites,” he said.
美国网络安全和基础设施安全局周三强烈敦促组织立即修补关键的 PHP 漏洞，并指出虽然该局“截至发布时尚未观察到这些漏洞被利用，但如果不修补，它们会给组织带来风险”。
The US Cybersecurity and Infrastructure Security Agency on Wednesday strongly urged organisations to patch the critical PHP vulnerabilities immediately, noting that while it “has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organisations if left unpatched”.
联邦调查局网络部门也在 X 平台发帖，敦促组织立即安装更新。
The FBI’s Cyber Division also urged organisations in a post on X to install the updates immediately.
“如果无法立即更新，建议组织将系统下线，直到能够完全缓解风险，”该部门表示。
“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated,” it said.
英国国家网络安全中心也建议更新到最新版本的 PHP，并继续监测更新情况。
The UK’s National Cyber Security Centre also recommended updating to the latest version of PHP and continuing to monitor for updates.
欧盟网络安全服务机构——联盟机构、实体、办公室和机关网络安全服务，也“强烈建议”进行更新。
The Cybersecurity Service for the Union institutions, bodies, offices and agencies, the EU’s cybersecurity service, also “strongly recommended” an update.
据英国广播公司报道，芬兰暂时关闭了政府的公共网络服务，而荷兰网络安全机构表示，因这些漏洞正在将其自身网站下线。
Finland temporarily shut down the government’s public web services, while the Netherlands’ cybersecurity agency said it was taking its own website offline because of the vulnerabilities, according to the BBC.