2026年10月下旬，网络安全研究人员披露了名为“PHP2Shell”的严重漏洞，该漏洞使数百万依赖PHP、WordPress和Drupal的网站面临远程代码执行和数据窃取的风险。
AI Tools Uncover Severe PHP2Shell Flaw in Decades-Old Legacy Code In late October 2026, cybersecurity researchers disclosed the critical 'PHP2Shell' vulnerability, which exposed millions of websites relying on PHP, WordPress, and Drupal to remote code execution and data theft.
这一底层的内存耗尽缺陷自2024年以来一直未得到解决，但Calif的研究人员在OpenAI的支持下，利用AI工具将这一崩溃缺陷升级为任意代码执行漏洞利用。PHP基金会成功在恶意行为者利用该漏洞之前部署了安全补丁。
The underlying out-of-memory flaw had lingered unaddressed since 2024, but researchers at Calif, supported by OpenAI, used AI tools to elevate the crash bug into an arbitrary code execution exploit. The PHP Foundation successfully deployed a security patch before bad actors exploited the vulnerability.
专家警告称，AI能力将大幅加速发现数十年遗留软件中的技术债务，加剧软件漏洞利用与开源维护之间的结构性不对称。
Experts warn that AI capabilities will drastically accelerate the discovery of technical debt across decades of legacy software, exacerbating structural asymmetries between software exploitation and open-source maintenance.