Web服务器技术栈的技术细节值得了解。最好别从电视新闻里学。上周，了解PHP还是小众的职业兴趣。这周，出租车司机都有看法了。PHP不是故事本身；它只是个例证。它之所以获得这最倒霉的聚光灯，有充分理由。它非常古老，而且看得出来。从20世纪90年代中期的根基生长而来，它从未受过规范的约束，虽然经历了大量重构和现代化，但它保留了20多年前的设计元素。
The technical details of web server stacks are worth learning about. Preferably not from the TV news. Last week, knowing about PHP was a niche professional interest. This week, cab drivers have opinions. PHP is not the story; it's the illustration. There are good reasons that it has this most unfortunate of spotlights. It's very old, and it shows. Growing from roots in the mid-1990s, it has never suffered from the straitjacket of a specification, and while it has seen a lot of refactoring and modernization, it retains design elements from more than 20 years ago.
PHP绝非唯一一个这样的项目：对更好性能、可靠性和功能的迫切需求，消耗了本该用于整理那些看似运行良好的丑陋内部结构的资源。直到有一天，技术债到期了。还会有很多这样的日子。PHP的意义在于它并不独特。细节没那么重要，虽然如果你想了解，这本带注释的漫画版既有趣又详尽。
PHP is emphatically not the only project where urgent demands for better performance, reliability, and features consume the resources needed to tidy up ugly internals that appear to work just fine. Until, one day, that technical debt falls due. There will be many more days like this. PHP's significance is that it isn't unique. The details don't matter that much, although this annotated comic book version is both fun and granular if you want to learn about it.
现在，AI辅助网络安全的动态变得更清晰了：防御者可以用工具发现危险缺陷，但有动机、有创造力的攻击者也能用。双方在资源和独创性上都没有垄断权。冲突的速度和规模增长得如此之快，以至于我们必须研究实际全球战争是如何运作的，才能重新配置。PHP2Shell最相关的方面是人，而不是机器。我们知道大语言模型是如何在8月的几天里识别出这组问题及其利用方式的，也知道关于此类事物的任何公开信息能多快被武器化。
Now the dynamics of AI-assisted cybersecurity are becoming clearer, defenders can use the tools to uncover dangerous flaws, but motivated and inventive attackers can use them too. Neither side has a monopoly on resources or ingenuity. The pace and scale of the conflict are growing so quickly that we have to look at how actual global warfare works to reconfigure. The most pertinent aspect of PHP2Shell is the people, not the machines. We know how the LLMs identified the mix of problems and their exploitation over a few days in August, and we know how quickly any public information about such things can be weaponized.
发现只用了几天而非几个月，利用只用了几小时而非几天。正确的协议是先私下向主要、受信任的组织披露补丁，核心服务受保护后，再公开并全力推进。但PHP2Shell并没有按此进行，因为它是个太诱人的美味，藏不住。
It took days, not months, to find, and hours rather than days to exploit. The correct protocol is to disclose patches privately to major, trusted organizations, and then when core services are protected, go public and go hard. But PHP2Shell didn't work out like that, because it was too tasty a treat to keep secret.
首批攻击出现在匿名 Hacker News 帖子发布数天前，该帖子披露了问题的存在及其严重程度。帖子给出了正确的 CVE 编号，发帖者属于知情圈子。泄露情报造成的毁灭性后果，以及在二战期间，保护宝贵数据机密与能够利用这些数据之间的张力，已显而易见。这促使建立了许可、分级制度和受过训练的联络官制度，使得布莱切利园等机构的成果得以在传递给需要者的途中经过筛选、引导和保护，并防止落入无关人员眼中。
The first attacks were seen days before the anonymous Hacker News post that announced the presence and severity of the problems. That post had the correct CVE numbers. It came from someone in the loop. The devastating effect of leaked intelligence and the tensions between keeping valuable data secret and being able to use it were abundantly apparent in the Second World War.
这套制度并不完美，安全研究人员也不必在棚屋里工作并假装成补给文员，但吸取的教训至今仍行之有效。披露必须是一项纪律，而非一套协议。提前告知整个 IT 安全团队毫无益处 —— 掌握机密的人数应控制在绝对最少，时间应尽可能长。这些人必须经过补丁开发者及其所在组织的培训和信任。如果你的组织无法派出符合最高标准的人员，你在获知机密的顺序上就会靠后。
This led to the system of clearances, classification, and trained liaison officers by which the output of places like Bletchley Park could be filtered, guided, and protected on its way to the people who needed it, and kept away from the eyeballs of those who didn't. It wasn't perfect, and security researchers don't need to work in huts while pretending to be supply clerks, but the lessons learned have proved good to this day. Disclosure needs to be a discipline, not a protocol. It's no good telling an entire IT sec team ahead of time – the absolute minimum number of people should hold the secret for as long as possible. They have to be trained and trusted by the patch developers and their own organizations.
补丁联络必须成为一个可雇佣的职位，在职业体系中占有一席之地并有资质要求。它需要成为行业级架构的一部分，使信息能双向流动。担任该角色人员的有无及素质将决定你在分级部署序列中的位置。这是在 IT 机器中一个极其混乱、极快变、后果极重的领域管理风险的一种方式。我们需要专注、情报和技能，正如我们在其他地方所期待的那样。
If your organization can't field someone with the highest of standards, you'll go down the pecking order of when you're entrusted with the secrets. Patch liaison has to become a hirable position with its place in career structures and qualification requirements. It needs to be part of an industry-wide structure where information can flow both ways. The presence and quality of the person in that role will define where you sit in the classified sequence of deployment. It's a way of managing risk in a very messy, very fast moving, and very consequential part of the IT machine.
要使这一切奏效，必须有人在整个行业层面统筹管理。工具和流程的开发必须以不披露即部署为明确目的。
We need focus, intelligence, and skills just as much as we expect them elsewhere. For all this to work, someone has to manage the whole thing across the industry.
与此同时，必须建立一套正式化的体系，用于识别、分析并迅速确定最危险基础设施组件的处置方案，既要考虑部署基础，也要考虑设计本质。例如，将会有大量争论 PHP 能否以及是否应该用 Rust 重写，但却没有一个能够高标准开展辩论、并提供相应资源以便快速做出决策的论坛。按某些标准衡量这很昂贵，按另一些标准衡量则极其低廉。
Tools and processes need to be developed with the explicit purpose of deploying without disclosure. Hand in hand with that must be a formalized system of identifying, analyzing, and setting in place expeditious factions for the most dangerous infrastructure components, both by deployed base and design nature. There will be a lot of arguments whether PHP can and should be Rusted, for example, but no forum where the debate can be run to a high standard and appropriate resources provided to make the decision happen quickly.
我们从未不得不正式思考如何将其建设为一门达到专业标准的学科，但我们也从未面对过这样一种组合：在一个敌意浓厚、装备精良的环境中，存在复杂而强大的攻击向量。这很严肃。这是战争。®
Expensive by some standards, staggeringly cheap by others. We've never had to think formally about this as a discipline to be built to professional standards, but we've never had such a combination of complex, powerful attack vectors in a hostile and richly equipped environment. It's serious. It's war. ®