OpenAI 和 Google 的 AI 模型发现了一个可能影响全球数百万网站的关键 PHP 漏洞。
GPT-5.6 Sol 作为 Patch-the-Planet 倡议的一部分追踪到了该缺陷，OpenAI 称这是“近年来最具影响力的安全问题之一”。该模型在攻击者之前发现了这些漏洞，为开发人员和安全供应商提供了响应的时间。GitHub 上的一个工具现在允许服务器运营商检查其 PHP 版本是否受到影响。
安全公司 Wiz 独立发现了相同的漏洞，使用了其自身的 Wiz Atlas 平台以及 Google 的 Gemini 4 Argon 和 GPT-5.6 Sol。据 Wiz 称，Gemini 4 Argon 在寻找漏洞、开发利用程序、构建攻击检测和验证补丁方面被证明特别有用。
AI 降低了攻击者的门槛
Wiz 解释说，曾经需要大量努力才能适应其他版本和配置的对特定 PHP 安装有效的利用程序，现在由于大型语言模型可以自动调整针对不同 PHP 版本、配置和内存布局的利用程序而消除了这一障碍。该公司写道：“这显著降低了在不同部署中扩展攻击的门槛”，并补充说“曾经看似难以利用的漏洞变成了可行的目标。”
修复工作历时两个月，分五个阶段协调进行，涉及 PHP 开发人员、Wiz、Cloudflare 以及包括 CISA 和白宫在内的美国机构。OpenAI 提议将此流程作为未来 AI 驱动的安全发现的重复性框架。
该公司预计类似 PHP2Shell 漏洞规模的发现将在“未来几个月急剧增加”，但警告称，能够发现漏洞的相同 AI 能力也能帮助攻击者。这一发现引发了关于 AI 模型攻防网络安全能力的长达数月的争论。
无炒作的人工智能新闻 – 由人类策划
订阅 THE DECODER，享受无广告阅读、每周 AI 通讯、每年六次的独家“AI Radar”前沿报告、完整档案访问权限以及评论区的访问权限。
立即订阅
查看原文
AI models from OpenAI and Google found a critical PHP vulnerability that could affect millions of websites worldwide.
GPT-5.6 Sol tracked down the flaw as part of the Patch-the-Planet initiative, which OpenAI calls one of the "most impactful security issues in recent memory." The model spotted the vulnerabilities before attackers did, giving developers and security vendors a window to respond. A tool on GitHub now lets server operators check whether their PHP version is affected.
Security firm Wiz found the same flaws independently, using its own Wiz Atlas platform alongside Google's Gemini 4 Argon and GPT-5.6 Sol. Gemini 4 Argon proved especially useful for finding the vulnerability, developing exploits, building attack detection, and validating the patch, according to Wiz.
AI lowers the bar for attackers
An exploit that worked against one specific PHP installation used to require significant effort to adapt to other versions and configurations, Wiz explains. Large language models remove that barrier because they can automatically adjust exploits across different PHP versions, configurations, and memory layouts. "This significantly lowers the barrier to scaling attacks across different deployments," the firm writes, adding that "vulnerabilities that once seemed impractical to exploit become viable targets."
The fix was coordinated over two months across five phases, involving PHP developers, Wiz, Cloudflare, and US agencies including CISA and the White House. OpenAI is proposing this process as a repeatable framework for future AI-driven security discoveries.
The company expects findings on the scale of the PHP2Shell flaw to "increase sharply in the coming months," but warns that the same AI capabilities that find vulnerabilities can help attackers too. The discovery feeds into a months-long debate over AI models' offensive and defensive cybersecurity capabilities.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
原文版权归 The Decoder 及原作者所有，本站转载仅供阅读。如需删除，请联系 support@aisa.one。
Studio