标题平淡无奇。研究人员发现了一种方法，可将 PHP 编程语言中的两个漏洞武器化，PHP 是一种用于网站和应用程序的编程语言，周三各公司被敦促安装补丁。部分网站和服务在安装补丁期间被迫下线。美国表示正在排查政府系统并加快缓解措施。媒体几乎未予关注。
The headlines were unremarkable. Researchers had found a way to weaponize two vulnerabilities in PHP, a programming language used for websites and apps, and companies were being urged on Wednesday to install a patch. A smattering of websites and services were taken offline while it was installed. The US said it was looking into government systems and expediting mitigations. The media barely blinked.
但正如一次被挫败的恐怖袭击，或是千年虫问题，那种“无事发生”的普遍感觉，可能掩盖了幕后为避免灾难而做出的英勇努力——至少目前如此。这就是本案的情况：这起事件应被视为新 AI-网络安全时代“好人”迄今取得的最重大胜利，也是渴望证明自身比以往任何时候都更有价值的网络安全行业的一大福音。
But like a thwarted terror attack, or the Year 2000 problem, the general feeling of a nothingburger can disguise the behind-the-scenes heroics that have — so far — averted catastrophe. That’s the case here: an incident that should be considered the most significant victory for the good guys so far in the new AI-cybersecurity age, a boon for the cybersecurity industry eager to prove it’s more valuable than ever.
据谷歌旗下网络安全公司 Wiz 称，这些漏洞——被命名为 PHP2Shell——有可能影响全球“约 70% 的网站”。这些深层的、根本性的缺陷已存在十多年，允许攻击者远程执行代码——相当于把一套钥匙交给外人，让其几乎可以为所欲为、无所不见。“这些发现属于 PHP 历史上最严重的漏洞之列，”Wiz 写道，“甚至可以说是软件史上最严重的漏洞之一。”极度谨慎的态度已蔓延全球。
The vulnerabilities — named PHP2Shell — stood to affect around “70% of all websites in the world,” according to Wiz, a cybersecurity firm owned by Google. These deep, underlying flaws, which had existed for more than a decade, allowed an attacker to execute code remotely — like handing a set of keys to an outsider to do and see almost anything it wanted. “These findings rank among the most severe vulnerabilities discovered in PHP,” Wiz wrote, “and arguably in software history.”An abundance of caution has gone global.
多个欧洲政府和地方政府的网站下线。在英国，BBC 部分网站因维护而下线。一家美国人力资源公司短暂下线。日本首相高市早苗敦促企业尽快应用补丁。然而到目前为止，这仅仅止步于极度谨慎。
Websites belonging to several European governments and local authorities went offline. In the UK, the BBC took parts of its website down for maintenance. A US-based human-resources company briefly went offline. Japan’s Prime Minister Sanae Takaichi urged companies to apply the patch quickly. Yet so far, that’s all this has amounted to: an abundance of caution.
PHP2Shell 这个安全漏洞是在 8 月份被发现的，其发现过程中使用了来自 OpenAI、Google 等顶尖研究机构的先进人工智能（AI）模型。Wiz 公司也在 8 月份发现了这个漏洞；同时，另一家名为 Calif 的网络安全公司也在同一时间发现了该漏洞。 Calif 公司是与 OpenAI 合作开展“Patch the Planet”项目的一部分，该项目旨在应对人们对 AI 可能增强网络犯罪分子和恶意国家攻击能力的担忧。
PHP2Shell was discovered in August with the help of “frontier” AI models, the term given to the cutting edge of what’s coming out of the leading labs, from OpenAI to Google. Wiz found the vulnerability in August. So, separately, did Calif, another cybersecurity firm, working with OpenAI as part of a coordinated effort called Patch the Planet, which was launched in the wake of fear around how AI could supercharge the capabilities of cybercriminals and rogue states.
需要明确的是，这个发现过程远比单纯依靠 AI 模型来寻找漏洞要复杂得多。实际上，这需要 AI 模型与人类专家的紧密协作，Wiz 公司将其描述为“一系列极其复杂的步骤，这些步骤已经接近人类研究人员实际能够完成的能力极限”。Wiz 公司表示，他们团队中的单一名研究人员仅用一周时间就完成了原本需要“世界级”团队数月才能完成的工作。
To be clear, this was a far more complex task than simply asking the AI model to find a problem. Rather, this was a concert of model and human specialists, allowing what Wiz described as “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.”A single researcher in Wiz’s team handled in a week what would’ve taken a “world-class” team months, the firm said.
漏洞被发现后，相关修复工作立即在幕后展开。PHP（一种开源编程语言）的维护团队立即开始开发相应的补丁程序。亚马逊网络服务（Amazon Web Services）和 Cloudflare 等知名互联网基础设施提供商也收到了通知。这些漏洞及其修复方案于周三被公开发布，补丁程序也在当天早上发布了——比原计划提前了一天，因为部分细节此前已被泄露。OpenAI 为其 Codex 平台提供了一套工具，帮助企业快速判断哪些系统需要更新。
With the flaws discovered, the mitigation effort kicked in behind closed doors. The team that administers PHP — it’s an open-source language — began developing its fix. Top internet infrastructure firms such as Amazon Web Services and Cloudflare were notified. The vulnerabilities (and the solution) were made public on Wednesday, with a patch released in the morning — a day ahead of schedule because some details had been leaked. OpenAI put out a “skill” for its Codex platform that helps companies quickly determine which updates are needed.
既然这些漏洞已经被公开，黑客们也会开始寻找并利用这些弱点，事实上他们已经这么做了。Cloudflare 的首席技术官 Dane Knecht 表示，在补丁发布之前，该公司就已经发现了一些针对其客户的攻击行为，并提供了临时防护措施，直到漏洞被彻底修复。不过，与这些攻击相比，如果这些漏洞首先被恶意分子发现，后果可能会更加严重。
Now that the exploit has been made public, hackers will be identifying those weak spots, too, and some have already done so. Dane Knecht, chief technology officer at Cloudflare, said the company had, before the patch was made available, seen “early attacks emerging” against its clients and was offering them stopgap measures until the weakness had been patched. These attacks are nothing compared with what might have happened had these vulnerabilities been discovered by bad actors first.
这一事件凸显了在人工智能时代，专业网络安全公司日益重要的作用。就在今年2月，由于投资者担心人工智能公司Anthropic会抢走它们的业务，Cloudflare和Crowdstrike等领先的安全公司的股价曾大幅下跌。如今看来，这种担忧实在荒谬至极——因为事实恰恰相反：新的安全威胁模式使得网络安全专业知识变得愈发宝贵。因此，Cloudflare的股价在相关消息发布后上涨了约7%，自2月份以来累计涨幅已达76%；Crowdstrike的股价同期则上涨了146%。
The incident underscores the growing importance of specialized cybersecurity firms in the AI age. It was only in February that the stocks of leading security companies like Cloudflare and Crowdstrike took a bath over investor fears that AI lab Anthropic was going to steal their business. What nonsense that seems today, with the opposite proving true. The new paradigm of security threats has made cybersecurity expertise more valuable, so it’s no surprise that Cloudflare shares rose around 7% on the news, up 76% since that February shock. Crowdstrike is up 146% in that time.
当然，这些人工智能公司也在帮助防范它们自己所创造的风险。不过，这个问题已经无法回避了：那些能够用于研发新药物或编写复杂代码的技术，同样也可以被用来攻击计算机系统。我们唯一的选择就是积极应对这些威胁。这一事件应该给我们带来鼓舞：安全研究人员与前沿人工智能实验室之间的合作，为世界应对这一严重威胁提供了先机。这种合作必须继续并得到进一步扩展。
Of course, the AI firms are helping defend against a risk they helped create, but that cat’s out of the bag now — the same technology that can discover new drugs or write complex code can be used to hack computers. The only course of action is to deal with it. This incident should provide encouragement. The takeaway is that a collaboration between security researchers and frontier AI labs gave the world a head start against a serious threat. These collaborative efforts must continue and be expanded.
我们仍未完全摆脱危险。在网络安全领域，责任始终在于安全团队本身。不过这些团队现在掌握了所有相关信息，并已准备好相应的补救措施；同时，由于有可靠的信息来源提供了经过深思熟虑的解决方案，他们也能保持相对冷静的态度。庆幸的是，这些事件并未登上报纸的头版或晚间新闻节目——这至少说明我们在这场永无止境的“战争”中取得了一场小小的胜利。
We’re not out of the woods yet. As ever in cybersecurity, the onus is still on security teams to act. But these teams do so in full possession of the facts, with a patch ready to go, and in a state of relative calm thanks to trusted sources offering well-considered remedies. The fact that none of this made it to the front pages or nightly news bulletins counts as a battle won in what will be a never-ending war.