跟进：PHP2Shell处置进入第二天：美三机构联合通告列明清点与下线要求，美国全国作家联盟预防性关闭官网

代号PHP2Shell的两个PHP严重漏洞（CVE-2026-109618、CVE-2026-109619）公开进入第二天，美国国家安全局（NSA）发布正式通告，与联邦调查局（FBI）、网络安全与基础设施安全局（CISA）联合敦促各机构立即修复。通告确认，漏洞位于PHP语言本身而非某个网站应用或配置，攻击者无需事先登录即可接管存在漏洞的网络服务器，严重程度评级为CVSS v4.0的9.2分。

三家机构给出的处置顺序是：全面清点所有依赖受影响PHP版本的系统，优先处理面向互联网的服务器与捆带PHP的第三方产品；为相关系统增加日志记录；已停止支持、无法打补丁的旧版本PHP应予替换；若无法立即升级，应将系统下线，直至完成修复。NSA在通告中表示，正优先识别可能利用这些漏洞的恶意行为者，并称风险程度要求美国政府各部门与机构立即打补丁。

PHP开发团队10月21日发布的修复版本为8.5.12、8.4.27、8.3.36与8.2.35；对已停止支持的7.4至8.1版本，官方只提供最小代码修复，5.4至7.3版本则没有修复。据W3Techs统计，PHP运行于其可识别服务器端语言的网站中的约69.3%，WordPress、Drupal与Joomla等广泛使用的建站系统均建立在PHP之上。漏洞技术细节在补丁发布前已经泄露，Cloudflare首席执行官Matthew Prince此前表示，利用尝试在公布后两小时内升至数十万次、随后达到数百万次。

在美国国内，美国全国作家联盟（National Writers Union）已向会员发出通知：因PHP2Shell漏洞，该联盟主动下线官网作安全防范，并提醒运营自有PHP网站的会员尽快自查升级。该联盟官网属于预防性下线，并非已被攻破。此前一天，英国技术大臣Baroness Lloyd of Effra在上议院通报，英国有32项政府服务因预防性措施不可用、4项部分不可用，英国国家网络安全中心已向企业与机构发出5万份警告；荷兰、芬兰、丹麦、法国与德国等多国政府网站亦采取预防性下线。日本首相高市早苗此前已发帖呼吁网站运营者打补丁。

据报道，这两个漏洞由安全机构Calif借助AI模型发现其中一处，Google旗下Wiz团队亦以AI工具独立发现两处；亚马逊AWS表示，攻击者在公开披露前4天已经开始利用这些漏洞。截至发稿，美国政府尚未公开确认有联邦网站因漏洞关停。

Follow-Up: PHP2Shell Response Enters Day Two as NSA, FBI and CISA Detail Patch-or-Offline Steps and the National Writers Union Takes Its Site Down as a Precaution

The response to PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, entered its second day as the U.S. National Security Agency (NSA) issued a formal advisory, jointly with the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), urging immediate fixes. The advisory confirms the flaws sit in PHP itself rather than in any hosted application or configuration, can let attackers take over vulnerable web servers with no prior access, and carry a CVSS v4.0 score of 9.2.

The agencies set out a sequence of steps: inventory everything relying on vulnerable PHP versions, prioritizing internet-facing servers and third-party products that bundle PHP; add logging; replace end-of-life PHP versions that cannot be patched; and, if an immediate update is not feasible, take systems offline until they are fully mitigated. The NSA said it is prioritizing identifying malicious actors who may exploit the flaws, and called the risk serious enough to require immediate patching across U.S. government departments and agencies.

The PHP team's fixes, released on October 21, are versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For unsupported branches from 7.4 to 8.1, only minimal code fixes are provided, and there is no fix for 5.4 to 7.3. According to W3Techs, PHP runs on about 69.3% of websites whose server-side language it can identify, and widely used systems including WordPress, Drupal and Joomla are built on it. Technical details leaked before the patch, and Cloudflare chief executive Matthew Prince has said exploit attempts reached hundreds of thousands within two hours of disclosure and millions thereafter.

In the United States, the National Writers Union has notified its members that it proactively took its own website offline as a security precaution because of PHP2Shell, and urged members who run PHP websites to check and update them. The union's site was taken down preventively; it was not breached. A day earlier, UK technology minister Baroness Lloyd of Effra told the House of Lords that 32 UK government services were unavailable and four partially unavailable, largely due to precautionary measures, and that the National Cyber Security Centre had sent 50,000 warnings to businesses and organizations. Government websites in the Netherlands, Finland, Denmark, France and Germany have also been taken offline as a precaution, and Japanese Prime Minister Sanae Takaichi has urged website owners to patch.

The flaws were reportedly found with AI assistance: security firm Calif found one of the bugs using an AI model, while Google's Wiz independently uncovered both with AI tools. Amazon's AWS says attackers were exploiting the flaws four days before public disclosure. As of publication, the U.S. government has not publicly confirmed any federal website shutdowns caused by the vulnerabilities.

来源：GSM·美国（原文链接）

图片来源：位于马里兰州Fort Meade的美国国家安全局总部。（Wikimedia Commons，Public domain，National Security Agency）Headquarters of the U.S. National Security Agency at Fort Meade, Maryland. (Wikimedia Commons, Public domain, National Security Agency)

本频道最新更多 ›

参议员 Marsha Blackburn 要求 Meta 撤回商业条款更新：称其授权抓取商家与创作者网站内容2026-10-23MiniMax宣布开源M3.1 Flash模型权重：428B参数、72小时处理Token超100万亿2026-10-23

← 返回科技　全部新闻　关于我们