网络安全组织日益依赖人工智能（AI）来发现漏洞并进行威胁分析，而最近发现的“PHP2Shell”漏洞进一步巩固了AI在识别风险和修补受影响代码方面的作用。
Cybersecurity organizations increasingly rely on artificial intelligence (AI) to spot vulnerabilities and conduct threat analyses, and the role of AI in identifying risks and patching affected code was further cemented by the recent discovery of the “PHP2Shell” vulnerability.
该PHP漏洞被列为高危威胁，在通用漏洞评分系统（CVSS）上的评分为9.2分（满分10分），攻击者可借此远程执行代码，入侵网络服务器。
The PHP vulnerability, classified as a high-severity threat with a score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), allowed attackers to compromise web servers by executing code remotely.
伊斯坦布尔奥兹耶金大学计算机工程副教授库布拉·卡尔坎·查克马克奇告诉阿纳多卢通讯社，人工智能可以加快软件调试速度，并同时评估数百万个潜在错误。
Kubra Kalkan Cakmakci, an associate professor of computer engineering at Istanbul-based Ozyegin University, told Anadolu that AI accelerates software debugging and helps evaluate millions of potential errors simultaneously.
她说：“在检测PHP2Shell漏洞时，人工智能能够同时快速分析多个层面，而人类一次只能处理并思考少数几个步骤。”
“AI was able to analyze multiple layers quickly at the same time when detecting the PHP2Shell vulnerability, while humans can only work on and think through few steps at a time,” she said.
她补充说：“确保网络安全免受漏洞侵害需要一种涵盖所有层面的整体方法，各组织必须为重大安全漏洞配备解决方案。”
“Ensuring cybersecurity against vulnerabilities requires a holistic approach addressing all layers, and organizations must have solutions in place for critical security breaches,” she added.
卡巴斯基网络安全公司高级安全研究员法提赫·森索伊告诉阿纳多卢通讯社，该PHP漏洞导致许多网站和平台进行维护，可能暴露明文会话数据以及信用卡详细信息等其他敏感信息。
Fatih Sensoy, a senior security researcher at cybersecurity firm Kaspersky, told Anadolu that the PHP vulnerability, which put many websites and platforms under maintenance, could expose plain-text session data and other sensitive information, such as credit card details.
他说：“将个人数据以加密格式存储在服务器上的独立数据库中，可以增加一些额外的安全机制，但一旦一个频繁使用的网站落入攻击者手中，从那时起一切都将任其摆布。”
“Storing personal data in an encrypted format on a separate database on the server could add a few extra security mechanisms, but once a frequently used website falls into the hands of the attacker, everything from that point on is at their mercy,” he said.
森索伊表示，人工智能本身不会识别这类漏洞，并指出像“Patch the Planet”这样的计划是由人类专家引导技术找到潜在薄弱点。
Sensoy stated that AI does not identify such vulnerabilities on its own, noting that initiatives like Patch the Planet have human experts guide the technology to potential weak spots.
“已发布更新以修补该漏洞，但开发补丁可能需要长达两到三天，而在网络安全领域，即使是一小时也至关重要——匿名攻击者也在密切关注这些更新，其唯一目的就是弄清如何利用已披露的漏洞，”他说。
“An update is released to patch the vulnerability, but developing a patch could take up to two to three days, but in cybersecurity, even an hour is crucial — anonymous attackers are also on the lookout for these updates with the sole objective of figuring out how to exploit a disclosed vulnerability,” he said.
“此类漏洞过去曾出现过，现在正在被披露，未来也将继续被披露——当我们面对此类事件时，应当建立快速响应方案，以将损失降至最低，”他补充道。
“Such vulnerabilities emerged before, and they are being disclosed now, and continue to be disclosed in the future — when we face such incidents, we should have rapid response solutions in place to minimize the damage,” he added.