跟进：PHP漏洞冲击扩大：英国确认32项政府服务预防性下线 大臣称未发现中央系统被攻破

代号 PHP2Shell 的严重漏洞正在把更多政府服务拽下线。英国技术大臣埃弗拉的劳埃德男爵夫人（Baroness Lloyd of Effra）10月22日在上议院通报：目前32项英国政府服务不可用，另有4项部分不可用。

“目前我掌握的情况是，32项政府服务不可用，4项部分不可用，”劳埃德在上议院说，“这主要是为保护系统而采取的预防性措施，相关安全更新和缓解措施正在应用中。”她同时表示：“我们目前没有发现中央政府系统因这些漏洞遭到攻破的确切证据。”这一判断随后被扩展到更广泛的英国公共部门。

受影响的服务没有完整名单，但已知预算责任办公室（OBR）已将其网站下线——而下周就是预算案公布周，时机颇为尴尬。有上议院议员还提到了驾驶员与车辆牌照局（DVLA）以及警察服务受到影响的报告。地方层面，爱丁堡、牛津、布里斯托尔、兰贝斯和巴尼特等多个地方议会的服务也传出下线消息。

英国不是唯一按下暂停键的。德国、法国、比利时、芬兰和荷兰的政府网站同样出于预防目的下线，澳大利亚的网络安全机构网站也在列。大西洋彼岸，美国国家安全局（NSA）敦促各机构立即修补或断开存在漏洞的系统，不过美国政府尚未公开确认有网站关停。

PHP2Shell 由两个严重漏洞组成，编号 CVE-2026-109618 和 CVE-2026-109619，可让未经认证的攻击者在存在漏洞的服务器上执行代码。英国国家网络安全中心（NCSC）已向企业和其他机构发出5万份警告。劳埃德透露，政府在公开披露前就已成立跨部门事件响应机制，NCSC 上周听取了 OpenAI 关于该漏洞的简报，并协调厂商做了披露准备。

关于漏洞的发现：安全公司 Calif 用 OpenAI 的 GPT-5.6 Sol 模型发现了其中一个 PHP 缺陷，谷歌旗下的 Wiz 则用 AI 工具独立发现了两个缺陷。亚马逊 AWS 表示，攻击者在公开披露前4天就已经在利用这些漏洞；Cloudflare 记录到的武器化尝试已达数百万次。

PHP Flaw Fallout Widens: UK Confirms 32 Government Services Taken Offline as Precaution; Minister Says No Confirmed Compromise of Central Systems

LONDON — The critical vulnerabilities dubbed PHP2Shell are dragging more government services offline. Tech minister Baroness Lloyd of Effra told the House of Lords on October 22 that 32 UK government services are currently unavailable and four more are partially unavailable.

"Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Lloyd told peers. "That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied." She added: "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," later extending that assessment to the wider UK public sector.

Whitehall has not published a full list, but the Office for Budget Responsibility (OBR) is known to have taken its website offline — awkward timing with next week's Budget looming. Peers also raised reports of disruption affecting the DVLA and police services. Beyond central government, councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet have reportedly taken services offline.

Britain is not alone. Government websites in Germany, France, Belgium, Finland and the Netherlands have also been taken offline as a precaution, along with Australia's cybersecurity agency website. Across the Atlantic, the NSA has urged organizations to patch or disconnect vulnerable systems, though the US government has not publicly confirmed any shutdowns.

PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre (NCSC) has sent 50,000 warnings to businesses and other organizations. Lloyd said the government established a cross-departmental incident response operation before public disclosure, and that the NCSC was briefed by OpenAI last week on the vulnerability to coordinate disclosure with vendors.

On discovery: security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz independently uncovered both flaws with AI tools. AWS says attackers were exploiting the flaws four days before public disclosure, while Cloudflare has recorded millions of attempts to weaponize them.

来源：GSM·美国（原文链接）

图片来源：图：伦敦白厅和平纪念碑（资料图）。Godot13 摄，CC BY-SA 4.0，经维基共享资源（Wikimedia Commons）。Photo: The Cenotaph, Whitehall, London (file photo). By Godot13, CC BY-SA 4.0, via Wikimedia Commons.

本频道最新更多 ›

参议员 Marsha Blackburn 要求 Meta 撤回商业条款更新：称其授权抓取商家与创作者网站内容2026-10-23MiniMax宣布开源M3.1 Flash模型权重：428B参数、72小时处理Token超100万亿2026-10-23

← 返回科技　全部新闻　关于我们