加利福尼亚州帕洛阿尔托/纽约讯 PHP编程语言安全漏洞的曝光，促使数百家日本网站下线维护，但美国同行则倾向于采取不影响服务的幕后修复措施。
PALO ALTO, California/NEW YORK -- The revelation of security flaws in the PHP programming language spurred hundreds of Japanese websites to go offline for maintenance, but their American counterparts tended to favor behind-the-scenes fixes that did not disrupt services.
PHP基金会周三公布了这些漏洞及其修补程序。该基金会负责监管约70%网站所使用的编程语言。
The vulnerabilities along with patches to fix them, were announced Wednesday by the PHP Foundation, which oversees the programming language used by roughly 70% of websites.
全球最大云服务提供商亚马逊当天敦促客户立即升级至修复后的PHP版本，并检查网络服务器日志，查找可疑活动。
Amazon, the world's largest cloud services provider, urged customers that day to upgrade immediately to the fixed PHP versions and to review web server logs for suspicious activity.
这些漏洞于8月由使用人工智能的网络安全公司发现。PHP基金会将信息共享给美国政府和科技公司，原计划周四发布补丁。
The flaws were discovered in August by cybersecurity companies using artificial intelligence. The PHP Foundation shared the information with the U.S. government and tech companies, originally planning to release patches on Thursday.
但随着本周早些时候漏洞信息开始在网上流传，发布计划被提前。亚马逊称，其最早在10月17日就观察到一次攻击尝试。迄今尚未确认有严重损害，但各公司仍保持警惕。
This was pushed up after information about the vulnerabilities began circulating online early this week. Amazon said it observed an attempted attack as early as Oct. 17. Although no serious damage has been confirmed so far, companies remain on guard.
在日本，金融、零售等领域的数百家机构让其网站下线。首相高市早苗在社交媒体帖子中写道，如果难以立即应用补丁，暂时停用网站可以是降低风险的有效方式。
In Japan, hundreds of organizations in finance, retail and other fields took their websites offline Prime Minister Sanae Takaichi wrote in a social media post that suspending sites temporarily can be an effective way to reduce risk if applying a patch right away is difficult.
相比之下，美国仅宣布了少量中断事件。其中包括维基百科托管方维基媒体基金会。
By contrast, a limited number of outages were announced in the U.S. Among them was the Wikimedia Foundation, which hosts Wikipedia.
塔夫茨大学网络安全政策教授约瑟芬·沃尔夫表示，与日本或一些欧洲国家相比，“美国的政府机构和组织采取这一预防措施的要少得多”。她说，这“导致了美国受影响较小的印象，但在后台，我认为正在采取类似措施，试图修补这些漏洞并加强安全”。
Compared with Japan or some European countries, "many fewer government agencies and organizations in the United States have taken this precaution," said Josephine Wolff, professor of cybersecurity policy at Tufts University. This "has led to the perception that the U.S. has been less impacted, but on the back end I think there are similar steps being taken to try and patch these vulnerabilities and shore up security," she said.
沃尔夫还表示：“加大网络安全投入和改善信息共享，也可能是美国机构似乎受干扰较少的原因，但我认为，美国机构和组织在为防止任何泄露而预防性地让服务下线这一问题上，可能只是表现出了显著更高的谨慎程度。”
"More spending on cybersecurity and better information sharing are also possible explanations for why U.S. institutions seem to be less disrupted, but I think there may also just be a significant difference in how cautious U.S. agencies and organizations are being about taking services offline preemptively to prevent any breaches," Wolff also said.
软件更新是企业的日常工作。2025年，网站、应用程序或系统组件中近5万个漏洞被公开披露。
Software updates are an everyday occurrence for businesses. Nearly 50,000 vulnerabilities in components of websites, apps or systems were published in 2025.
但修改系统的一个部分可能在其他地方引发问题。许多日本公司显然出于极度谨慎，选择让网站下线。
But modifying one part of a system can create problems elsewhere. Many Japanese companies apparently chose to take websites offline out of an abundance of caution.
虽然自9月以来日本的数据泄露事件激增，但美国尚未看到此类威胁报告大幅增加。但在绝对数量上，美国遭受的攻击数量要高得多。
While data breaches have soared in Japan since September, the U.S. has yet to see many more reports of such threats. But in absolute terms, the number of attacks in the U.S. is far higher.
微软的一份报告显示，在其客户中，美国占网络攻击最大份额，达1月至6月总量的25.5%。日本排名第八，占2.5%。
A report by Microsoft showed that the U.S. accounted for the largest share of cyberattacks among its customers, at 25.5% of the January-June total. Japan ranked eighth at 2.5%.
美国网络安全公司Proofpoint在5月对首席信息安全官进行的一项调查显示，89%的美国受访者表示其组织在未来12个月内面临重大网络攻击风险，而日本这一比例为46%。
In a May survey of chief information security officers by American cybersecurity company Proofpoint, 89% of U.S. respondents said their organizations were at risk of a material cyberattack in the next 12 months, compared with 46% in Japan.
西华盛顿大学计算机科学副教授、网络安全研究员迈克尔·齐克德基斯指出，保险是美日应对网络威胁的一个差异所在。
Cybersecurity researcher Michael Tsikerdekis, a Western Washington University associate professor of computer science, points to insurance as a difference between U.S. and Japanese responses to cyber threats.
美国公司通常持有网络保险单以覆盖泄露成本，但这些合同强制要求采取充分的安全措施。日本在采用此类保险方面落后了。
American companies often hold cyber insurance policies to cover the cost of breaches, but these contracts mandate adequate security measures. Japan has lagged behind in adopting such insurance.
齐克德基斯表示，这种安全网“可能也起到了作用”，导致了应对措施的差异。
That safety net "may have also played a role" in the differing responses, Tsikerdekis said.
美国国家标准与技术研究院和网络安全与基础设施安全局等美国政府机构在美国及国际网络安全规则制定中发挥着重要作用。据包括OpenAI在内的消息来源称，OpenAI在发现PHP安全漏洞方面发挥了作用，CISA参与了PHP基金会的初步讨论。
Such American government bodies as the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency play a major role in cybersecurity rulemaking in the U.S. and internationally. CISA was involved in the PHP Foundation's preliminary discussions, according to sources including OpenAI, which played a role in discovering the PHP security flaws.