这是一篇基于与Nick Woodhead对话的第一人称文章。Nick Woodhead是AI公司GPTree的创始人，同时担任Rothco和Compubox的首席技术官。他在周四接受《商业内幕》采访，分享了他如何应对PHP编程语言中的漏洞，这些漏洞可能影响全球大多数网站。以下内容经过编辑，以求简洁明了。
This is an as-told-to essay based on a conversation with Nick Woodhead, founder of the AI company GPTree and chief technology officer at Rothco and Compubox. He spoke with Business Insider on Thursday to share how he's responded to vulnerabilities in the PHP programming language that could affect the majority of the world's websites. The following has been edited for brevity and clarity.
这种事情发生时总是噩梦。自周二晚上以来，我就没合过眼。这已经接近连续工作48小时了。我是首席技术官，但同时也经营一家服务多个客户的代理公司，还有自己的公司和产品。所以，平衡时间把所有东西都更新到位——简直累人透顶。
It's always a nightmare when these things happen. Since Tuesday evening, I haven't slept. It's coming close to 48 hours working on this. I'm a CTO, but I also run an agency for multiple clients and have my own company with my own product. So, balancing my time to get everything updated — it's just been exhausting.
大约70%的互联网运行在一种叫PHP的编程语言上。我深度参与PHP社区，所以周二晚上收到了关于该漏洞的预警，以及PHP团队已经在处理的消息。这让我抢占了先机。我有一些离岸团队，所以能立刻和他们一起着手处理。
About 70% of the internet runs on a programming language called PHP. I'm actively involved within the PHP community itself, so I did get a warning on Tuesday evening regarding the vulnerability and the fact that it was already being addressed by the PHP team. That gave me a head start. I have some teams offshore, so I was able to jump on that with them.
光打补丁是不够的。还得确保没有任何东西已经暴露在外。我们早已建好基础设施，能轻松部署补丁，但仍需大量人工介入。我知道周三一进办公室，就得让团队马上动手。他们早就等着补丁发布了。
It's not just applying the patches. It's making sure that nothing was already exposed. We already had infrastructure in place to easily deploy patches, but it still requires a good amount of manual involvement. I knew that as soon as I walked into the office on Wednesday, I'd have to have my teams jump on this. They were already waiting for the patches to be released.
最大的头疼事之一，尤其是在客户端，是我们有大量遗留系统，运行在不再受支持的旧版PHP上，官方不会再出补丁。针对这些，我们只能另想办法。比如暂时把网站下线，或把它们移到VPN后面。
One of the biggest headaches, especially on the client side, is that we have a lot of legacy systems, which are running on older versions of PHP that are no longer supported, and official patches are not going to be produced. For those, we ultimately had to come up with other plans. For example, taking sites temporarily offline or moving them behind VPNs.
最终，因为是开源社区，那些补丁已经被社区移植回旧版本，或由社区实现了。所以现在我们又在忙着回头给那些旧系统打补丁。
Eventually, because it's an open-source community, those patches have already been backported, or implemented, by the community. So now we're shuffling back to some of those older systems to get them patched.
这是 PHP 的优点之一。它拥有庞大的社区，大家都愿意挽起袖子、投入其中并伸出援手。尽管我过去 10 年一直处于领导岗位，但我从未放松过对代码和基础设施的把控，始终保持着紧密联系。因此，我一直亲力亲为地与开发团队和基础设施团队合作，帮助确保这些问题得到解决。我们一直在审查日志，寻找该漏洞可能暴露的任何潜在入侵迹象。
That's one of the nice things about PHP. There's such a vast community of people all willing to roll up their sleeves and jump in and help. Even though I've been in leadership for the last 10 years, I've never taken my hand off the pulse in terms of being connected with the code and the infrastructure. So, I've been hands-on with the development and infrastructure teams to help make sure these issues are resolved. We've been reviewing logs and looking for any potential signatures of a breach that this vulnerability exposed.
这也意味着要跟上最新发布的消息以及其他人的发现。我们现在处于一种感觉舒适且安全的状态，但编码工具 Node.js 中出现了新的漏洞。我们运行着一些 Node 服务，所以现在正在研究这可能对我们产生什么影响。从技术角度来看，十月似乎就是“地狱月”。随着 AI 的进步，我看不到尽头。尽管我们从中获得了诸多积极成果，但也存在大量负面影响，这就是一个典型例子。
It's also meant keeping up to speed with the latest news that's coming out and what other people are finding. We're in a position now where we feel comfortable and safe, but there are new vulnerabilities in the coding tool Node.js. We have some Node services, so now we're looking at how that potentially affects us. October just seems like the month of hell from a technology perspective. I don't think there is an end in sight with the advancements in AI. For all the positives we get from it, there are a whole bunch of negatives, and this is a perfect example.
OpenAI 已经表示，他们发现了更多此类漏洞，所幸尚未泄露。在未来几个月里，这些漏洞要么会被修补，要么这些信息将以同样的方式泄露，引发同样的恐慌。我认为我们还没走到尽头。未来还会有更多事情发生。
OpenAI has already stated that they found many more of these types of vulnerabilities that, thankfully, haven't been leaked. Over the coming months, they are either going to be patches or this information is going to get leaked in the same way and cause the same kind of panic. I don't think we're at the end of the road yet. There's going to be a lot more to come.