Cloudflare首席执行官马修·普林斯在X上表示，自周三漏洞披露以来，黑客已进行了数百万次利用PHP2Shell的尝试。德国、荷兰和日本官员称，他们尚未发现任何一次尝试成功。
Hackers have made millions of attempts to exploit PHP2Shell since Wednesday’s disclosure, Cloudflare’s chief executive, Matthew Prince, said on X. Officials in Germany, the Netherlands and Japan say they have not seen one succeed.
普林斯周四早些时候写道，在公告发布前的10个小时内，Cloudflare观察到数千次尝试。随后45分钟内，这一数字跃升至数万次，两小时内达到数十万次。
Cloudflare saw thousands of attempts in the 10 hours before the announcement. That jumped to tens of thousands in the next 45 minutes and hundreds of thousands within two hours, Prince wrote early on Thursday.
德国网络安全机构BSI副总裁托马斯·卡斯珀斯对Politico表示，该机构已观察到攻击，但未发现漏洞被成功利用。
Germany’s cyber agency, the BSI, has seen attacks but no successful use of the flaws, its vice-president, Thomas Caspers, told Politico.
“利用起来似乎比预期要复杂一些。在补丁发布之前进行规划时，我们原本预计攻击者的进展会快得多，”卡斯珀斯说。
“It seems a little bit more complicated than expected to exploit. When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers,” Caspers said.
暂无确认的入侵事件荷兰网络安全机构负责人马蒂斯·范阿梅尔斯福特对Politico表示，该机构没有迹象表明该漏洞正被积极滥用。美国网络安全机构CISA在周三的警报中表示，当时尚未发现漏洞被利用的情况。
No confirmed break-ins The head of the Dutch cyber agency, Matthijs van Amelsfort, told Politico it had no indication the flaw was being actively misused. The US cyber agency CISA said in its alert on Wednesday it had not seen exploitation at the time.
PHP基金会执行董事伊丽莎白·巴伦周三对CNBC表示，尚未发现可用的漏洞利用程序。安全初创公司Tolmo的研究员马特·苏伊什对CNBC表示，他的团队在不到一天内就构建了一个。
Elizabeth Barron, executive director of the PHP Foundation, told CNBC on Wednesday that it had seen no working exploits. Matt Suiche, a researcher at the security startup Tolmo, told CNBC that his team had built one in less than a day.
“目前看来，漏洞利用并未大规模展开或广泛传播，”协助发现这些漏洞的加州研究员瑞安·奥斯汀对《卫报》表示。
“At the moment it doesn’t look like exploitation has taken off or been widespread,” Ryan Austin, the Calif researcher who helped find the flaws, told the Guardian.
银行和航空公司离线中断波及欧洲各地的网站之外。日本首相高市早苗在X上敦促网站所有者尽快安装修复程序。
Banks and airlines offline The disruption spread beyond websites across Europe. Japan’s prime minister, Sanae Takaichi, urged site owners on X to install the fix as soon as it came out.
“我们紧急请求大家今晚采取行动，”高市早苗写道，此语由Business Insider翻译。
“We have an urgent request for everyone to take action tonight,” Takaichi wrote, in a translation by Business Insider.
彭博社报道，瑞穗银行的银行和证券部门周四暂停了服务。静冈银行暂停了其网站和应用，三菱日联金融集团旗下公司暂停了部分在线服务。全日空在Apple Wallet中禁用了登机牌，并表示未发现任何泄露证据。日本航空、东日本旅客铁道和日本7-Eleven下架了部分网络服务。内阁官房长官木原稔表示，尚未确认有利用这些漏洞的攻击发生。
Mizuho’s bank and securities arms halted services on Thursday, Bloomberg reported. Shizuoka Bank suspended its website and app, and companies in the MUFG group halted some online services. All Nippon Airways disabled boarding passes in Apple Wallet, saying it had found no evidence of a breach. Japan Airlines, East Japan Railway and Seven-Eleven Japan took some web services down. Chief Cabinet Secretary Minoru Kihara said no attacks exploiting the flaws had been confirmed.
在法国，Orange在部署补丁期间暂停了对部分网站和应用的访问。据BBC报道，在英国，一名政府发言人表示正在努力查明其自身在线服务中是否存在任何暴露风险。《卫报》称，韩国提高了私营部门的网络警报级别。
In France, Orange suspended access to some websites and apps while it deployed the patches. In Britain, a government spokesperson said it was working to identify any exposure in its own online services, the BBC reported. South Korea raised its cyber alert level for the private sector, the Guardian said.
补丁发布前的尝试 这些尝试在漏洞公开之前就已开始。亚马逊表示，有人在10月17日试图利用PHP2Shell，即披露前四天。该尝试从一个匿名地址攻击了其诱饵服务器。亚马逊首席信息安全官CJ·摩西表示，目前不清楚攻击者是如何在禁令期内获得漏洞利用细节的。
Attempts before the patch The attempts started before the flaws were public. Someone tried to exploit PHP2Shell on 17 October, four days before disclosure, Amazon said. The attempt hit its decoy servers from an anonymised address. CJ Moses, Amazon’s chief information security officer, said it was unclear how the attacker got exploit details during the embargo.
领导紧急补丁背后联盟的OpenAI曾表示，据其所知，AI先于攻击者发现了这些漏洞。亚马逊在UTC 14:00发布前的数小时内记录了来自多个行为者的更多尝试。
OpenAI, which led the coalition behind the emergency patches, had said that, to its knowledge, AI found the flaws ahead of attackers. Amazon logged more attempts from several actors in the hours before the 14:00 UTC release.
“PHP2Shell现在正被广泛地在野利用，”摩西写道。
“PHP2Shell is now being broadly exploited in the wild,” Moses wrote.
他说，分析仍在进行中。目前不清楚是否有任何尝试会在真实系统上奏效。据彭博社报道，亚马逊未提供任何受害者的信息。
Analysis was still going on, he said. It was unclear whether any attempt would have worked on real systems. Amazon gave no information on any victims, Bloomberg reported.
披露本身现在也存在争议。PHP基金会表示，Chainguard在发布前六个多小时就发布了已打补丁的镜像，违反了禁令。Chainguard首席执行官丹·洛伦克告诉The，他的公司没有泄露。他说，之所以提前发布修复，是因为人们已经受到攻击，他不会做任何不同的事情。
The disclosure itself is now in dispute. The PHP Foundation has said Chainguard broke the embargo by publishing patched images more than six hours before the release. Chainguard’s chief executive, Dan Lorenc, told The his company did not leak. He said it shipped the fixes because people were already being hit, and would not do anything differently.
洛伦茨说：“这是协调漏洞披露，除非有证据表明存在活跃的野外利用。”
“It’s coordinated vulnerability disclosure, unless there’s evidence of active exploits in the wild,” Lorenc said.