我曾在一处正在建设购物中心的工地对面工作。我们被告知，施工过程中可能会挖出二战遗留的未爆弹。
I once worked opposite a site where a shopping centre was being built. re warned there might be unexploded bombs from World War Two unearthed during the construction.
最终并未发现，但作为预防措施，相关程序已制定完毕，我们所有人都必须演练有序撤离至大楼内指定的安全区域。
In the end, there were none, but procedures were put in place as a precaution and we all had to practice filing into designated safe zones inside our building.
PHP 事件给人的感觉，就像是网络世界里的一颗未爆弹——我从未见过针对一个尚未发生的网络事件，会引发如此戏剧性、公开且全球性的反应。
The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.
并没有像 2025 年 M&S（马克斯·斯宾塞）和 JLR（捷豹路虎）遭遇的勒索软件攻击那样造成实质性的痛苦破坏。
There has been no painful attack like the ransomware we saw knock out M&S and JLR in 2025.
但潜在威胁极其严重，以至于世界各地的网站纷纷作为预防措施主动下线。
But the potential threat is so serious that websites around the world have been taken down as a precaution.
不到两个月前，100 家科技公司联名发表公开信，警告世界在 AI 时代必须采取新级别的网络韧性。事实证明，我们不必等太久就能明白他们的含义。
Less than two months ago, 100 tech companies wrote an open letter warning the world to adopt a new level of cyber resilience in the age of AI. It turns out we didn't have to wait very long to find out what they meant.
在为数百万网站所用的 PHP 编程语言中发现的弱点，已静静潜伏多年，且不易被利用。
The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit.
一位网络安全研究人员告诉我，他熬了一整夜试图以实验方式加以利用，但证明非常困难。然而，对人类极其困难的事情，对 AI 来说越来越不成问题。
One cyber security researcher told me he'd been up all night trying to do it as an experiment, but it was proving very difficult. However, things that are very difficult for humans are increasingly very little trouble for AI.
此次技术因协助研究人员发现漏洞而获得大量赞誉，PHP 基金会（负责监管该编程语言）也迅速介入并发布了修复补丁。
The tech is getting a lot of credit here for assisting researchers in finding the bugs, and the PHP foundation, which oversees the programming language, was on the case and issued a fix.
原本计划保密，直到所有人都有机会修复各自网站——但消息泄露了。从那时起，时钟开始滴答作响。
It was supposed to be kept quiet until everyone had a chance to fix their sites - but the news was leaked. From that point the clock started ticking.
在我撰写本文之际，尚无任何报告表明有人或任何事物已成功利用这些缺陷攻击网站。
As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site.
“这里存在一个真正的两难困境，”萨里大学的艾伦·伍德沃德教授说。
"There's a real dilemma," said Prof Alan Woodward from Surrey University.
“如何在不提醒攻击者的前提下，提醒人们做好准备，并告知他们急需打补丁？”
"How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers?
“基本上，你是在同一时间把问题告诉所有人，并希望防御者没有足够警觉，在补丁发布后立即采取行动。”但我们确实从 Cloudflare 和 Palo Alto Networks 等大型网络公司了解到，已经发生了数百万次攻击尝试。
"Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out." But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made.
我们可能要过一段时间才能知道犯罪分子是否得逞，因为受影响的公司可能自己还没察觉。
We probably won't know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either.
据我们所知，这颗“未爆弹”目前仍保持完好，对一些专家来说，这本身就是一种成功。
As far as we know the unexploded bomb remains intact for now, and for some experts this is a success.
伦敦玛丽女王大学负责任人工智能教授吉娜·内夫（Gina Neff）将此描述为一个好消息。
Gina Neff, Professor of Responsible AI at Queen Mary University, described this as a good news story.
她在 BBC Radio 4 的《今日节目》（Today Programme）中表示：“我们看到了一个由大型 AI 公司支持的团队，如何利用 AI 发现问题、携手工作数月加以解决，并让所有人做好准备，保障安全。”
"We've seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and secure," she told the Today Programme on BBC Radio 4.
“我们拥有巨大的能力来应对这些风险。”但坏人也能利用 AI，那些相同的工具此刻很可能正在疯狂运转，试图闯入。
"We have enormous capability to handle these risks." But the baddies can use AI too, and those same tools are probably churning away right now trying to get in.
网络安全机构正警告网站所有者立即修复漏洞，但补丁仅适用于最新版本的 PHP，因此旧版网站必须先升级。
Cyber security authorities are warning website owners to fix the weaknesses immediately, but the patch only works on the latest version of PHP, so older sites will need to upgrade first.
对许多人来说，这可能是一项大规模的修复工作，所以如果你身边有网页开发者，不妨送上祝福、祈祷，或许再加一杯浓咖啡。
For many it may be a significant repair job, so if there's a web developer in your life you may want to send them thoughts, prayers and maybe a strong coffee.
