[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-openai-php-rce-coordinated-disclosure":3,"topics-all":38,"news-related-488f30b2-34b1-48e4-b67f-9187f15c1a71":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"488f30b2-34b1-48e4-b67f-9187f15c1a71","AI 抢先挖出 PHP 漏洞，披露窗口先被自己人捅破","PHP 项目 10 月 21 日释出四个安全版本，修掉两个可致未认证远程代码执行的高危漏洞。OpenAI 称 Calif 用 GPT-5.6 Sol 先于攻击者定位缺陷，Wiz 独立上报。但这扇披露窗口仍被自己人捅破：CVE 编号提前外泄、PoC 视频误发、发行版抢跑发布补丁镜像。","两个漏洞本身不复杂：一个请求把 PHP 的内存撑爆在错误的时刻，一个致命错误在错误的时刻中断处理。值得看的，是围绕它们发生的一连串事——防守的一方，亲手砸了自己的时间窗。\n\n## 漏洞本体：两笔拖了两年的旧账\n\nPHP 项目 10 月 21 日释出 8.5.12、8.4.27、8.3.36 和 8.2.35 四个版本，修的是 CVE-2026-109618 与 CVE-2026-109619 两个高危漏洞。在特定条件下，未认证的攻击者可在服务器上执行任意代码。Cloudflare 的技术说明写得很直白：两个漏洞都出在 PHP 处理 HTTP 请求出错后的清理逻辑上——要么是内存耗尽时留下尚未初始化完的内部数据，后续请求把它当成有效数据继续用（109618）；要么是致命错误后进程仍持有指向已释放内存的引用，同一 worker 处理下个请求时踩进已回收区域（109619）。按 Cloudflare 引用的统计，PHP 跑在全球接近 70% 的网站上；漏洞位于运行时内部，光改网站代码或插件并不顶用，只能升级解释器本身。\n\n麻烦的是，这不是新账。2024 年 PHP 做了多年来第一次外部安全审计，由基金会通过 OSTIF 拿到主权科技署资助、交给 Quarkslab 执行。就是在那次审计中，一位基金会签约的核心开发者发现了 OOM 问题最初迹象；团队当时推演过利用方式，但没找到具体攻击向量。基金会自认这拖延成了一次「结构性失败」：为修它，安全团队试过几种互相冲突的方案，每个都带着向后兼容断裂、新增 DoS 面或要动第三方扩展的代价，修复在几个月里反复停顿重启。\n\n## AI 找到了，人类把流程搞崩了\n\n真正改变节奏的是 7 月之后。基金会 5 月成立 Ecosystem Security Team，7 月和 9 月增聘负责分诊和加固的工程师，并引入 Anthropic 的 Claude Mythos 扫描、OpenAI Daybreak Red 验证报告与利用代码。7 月 30 日，安全公司 Calif 启动对 PHP 审计；8 月 11 日，研究员 Ryan A 报出一个无条件远程代码执行，根因与 2024 年那个 OOM 问题相同。同日 OpenAI 独立报出同一根因，8 月 24 日 Wiz 补上另一条攻击路径，9 月 18 日 OpenAI 又补新向量。\n\nOpenAI 的说法是：据其所知，前沿模型先于攻击者发现了这些漏洞，因此存在一个「防守者窗口」，让维护方和供应商得以先行准备。它把这称为近期最重大的安全问题之一，并宣布通过 Daybreak for Frontline Defenders 承诺 10 亿美元的补贴访问额度，面向安全资源有限却要守护关键服务的机构（[OpenAI 官方公告](https:\u002F\u002Fopenai.com\u002Findex\u002Fcoordinated-disclosure-of-critical-vulnerabilities\u002F)）。\n\n然后窗口就碎了。按基金会的记述：10 月 20 日周二约 15:00 UTC，两个 CVE 编号开始在论坛和社交媒体流传，附带错误的发布时间和错误的 10.0 评分（实际 9.2），但没泄露技术细节。项目组随即把预告提前到 19:30 UTC 发布，正式发布从 22 日 14:00 UTC 提到 21 日 14:00 UTC。约 20:00 UTC，报漏的 Calif 误发演示 PoC 的视频，副本很快扩散。当晚 23:00 UTC 前后，基金会发给关键基础设施机构的缓解建议疑似外泄，但发布时团队未发现可用的完整利用代码。\n\n最后一击在 21 日 07:41 UTC：Chainguard 单方面打破禁令，提前六个多小时发布了带修复的镜像版本。其他 PHP 用户还在等正式发布时，攻击者已可以拿二进制版本来研究这个补丁了。\n\nCloudflare 的速度值得一提：WAF 防护从 10 月初开始部署，比公开披露早约九小时，21 日 03:02 UTC 起免费和付费客户默认全部生效。Cloudflare 称观测到针对客户的攻击流量，攻击者在变换载荷试图绕过规则。为此他们开发了「完整事务检测」能力，把请求侧和响应侧信号放进同一 HTTP 事务判断，php2shell 是其首批托管规则。\n\n## 更该关心的是那套框架\n\nOpenAI 真正想推的并不是某一个漏洞，而是一套面向 AI 时代的响应框架：上游验证并修复（含用前沿模型做对抗测试）、给受影响机构留准备时间、协调政府伙伴、让下游产品准备更新、补丁就绪后发布指引。PHP 这次，OpenAI 称团队接触了白宫 Super Intelligence Force、美国网络国家总监办公室、CISA 等部门。框架外还有面向维护者的 Codex for OSS 订阅，以及对 Rust 基金会的白金赞助。\n\n## 值得记住的三件事\n\n基金会说，7 月 1 日以来安全团队已发布 15 个 CVE，同时处理了超过 100 份被判为无效或无法复现的报告。AI 帮着验证报告、归并同根因条目，但每个判断、每个补丁仍由人把关。\n\n第二件事更实用——站点若跑在托管服务上，Cloudflare 的建议是直接让服务商打补丁。WAF 防护属于纵深防御的一层，不能替代升级。Solidot 转述安全公司 Sansec 的判断称，补丁释出后 15 分钟内就可能出现大规模利用，约 130 万台主机受影响。这些是第三方预测而非既成事实，但作时间线参照够用。\n\n第三件事：这次流程的每个失误，方向都高度一致。CVE 编号在正式披露前近 24 小时外泄，演示视频在禁令窗口内误发，发行版为让自己用户先排队而提前六小时发布。这些行为的动机大多不是恶意——分发商只是怕自己的用户排不上队——但只要一个环节先跑，速度优势就换不回时间。\n\n所以呢？OpenAI 说，他们预计这类发现会在未来几个月「急剧增加」。当挖掘速度由模型决定、协调速度仍由一屋子开会的人决定时，披露流程就成了那块最短的木板。而这次是防守方自己把它拆的。","https:\u002F\u002Fopenai.com\u002Findex\u002Fcoordinated-disclosure-of-critical-vulnerabilities\u002F","15975962-b5fe-49e5-ae68-687ba6cb7015",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"b9bd9039-fcdb-41a8-b85b-fc1587def2b9","open-source",{"id":19,"name":20,"slug":20,"description":14,"color":14},"42e59a88-7795-47dc-a334-ef1e72c24347","openai",{"id":22,"name":23,"slug":23,"description":14,"color":14},"02bfdc0f-5e23-4fbb-b31a-7cc03cdba1ee","security",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"5c36e044-7e09-4996-9e96-f3d25e9ef8f6","en","AI found the PHP bugs first, defenders broke the embargo","PHP shipped four security releases Oct 21, fixing two critical RCE bugs OpenAI says Calif found with GPT-5.6 Sol. Defenders broke the embargo.","The two vulnerabilities are not complicated. One request pushes PHP memory to its limit at exactly the wrong moment; a fatal error interrupts processing at exactly the wrong moment. What is actually worth watching is the chain of events that unfolded around them: the people responsible for defence personally broke their own time window.\n\n## The bugs themselves: two debts left open for two years\n\nOn October 21 the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical issues tracked as CVE-2026-109618 and CVE-2026-109619. Under the right conditions, an unauthenticated attacker can execute arbitrary code on the server. The Cloudflare technical writeup puts it plainly: both flaws sit in how PHP cleans up after an HTTP request goes wrong. Either memory runs out and PHP leaves behind internal data that was never fully initialised, and a later request treats it as valid (109618); or a fatal error leaves the process still holding references to memory that has already been released, so the same worker trips into reclaimed space when it handles the next request (109619). According to the statistics Cloudflare cites, PHP runs on close to 70 percent of websites, and because the bugs live inside the runtime itself, changing site code or plugins does not help. The only fix is to upgrade the interpreter.\n\nThe awkward part is that this is not a new debt. In 2024 PHP underwent its first external security audit in years, funded by the PHP Foundation through OSTIF and carried out by Quarkslab. It was during that audit that a core developer contracted by the Foundation first spotted signs of the OOM problem; the team theorised about exploitation at the time but found no concrete attack vector. The Foundation now calls the resulting delay a structural failure: several mutually conflicting approaches were tried for the fix, each carrying the cost of backward-compatibility breakage, a new denial-of-service surface, or changes reaching many third-party extensions, and the repair stalled and restarted repeatedly over months.\n\n## AI found it, then humans broke the process\n\nWhat genuinely changed the pace came after July. In May the Foundation created the Ecosystem Security Team, added engineers in July and September responsible for triage and hardening, and brought in Anthropic Claude Mythos for scanning along with OpenAI Daybreak Red for validating reports and exploits. On July 30 the security firm Calif began auditing PHP. On August 11 researcher Ryan A reported an unconditional remote code execution with the same root cause as the OOM issue found back in 2024. OpenAI independently reported the same root cause the same day, Wiz supplied another attack path on August 24, and OpenAI added further vectors on September 18.\n\nOpenAI states that, to its knowledge, frontier models found these vulnerabilities before attackers did, which means a defenders window existed in which maintainers and suppliers could prepare. It calls this one of the most impactful security issues in recent memory and committed 1 billion dollars in subsidised Daybreak access through Daybreak for Frontline Defenders, aimed at organisations with limited security resources protecting essential services (OpenAI official announcement: https:\u002F\u002Fopenai.com\u002Findex\u002Fcoordinated-disclosure-of-critical-vulnerabilities\u002F).\n\nThen the window shattered. According to the Foundations account: at around 15:00 UTC on Tuesday October 20, the two CVE identifiers began circulating on forums and social media, carrying an incorrect release time and an incorrect CVSS score of 10.0 (the real score is 9.2), though no technical details leaked. The project moved its pre-announcement up and published at 19:30 UTC, pulling the release forward from 22 October 14:00 UTC to 21 October 14:00 UTC. At roughly 20:00 UTC Calif, one of the firms that reported the issues, mistakenly published a video demonstrating its proof of concept, and copies spread quickly. Around 23:00 UTC that evening, mitigation advice the Foundation had sent to critical infrastructure providers appears to have leaked as well, though at release time the team had identified no working exploit.\n\nThe final blow landed at 07:41 UTC on the 21st, when Chainguard unilaterally broke the embargo and published built images containing the fix more than six hours early. While other PHP users were still waiting for the release, attackers could already study the patch in binary form.\n\nCloudflare speed is worth noting: its WAF protections were deployed from early October, roughly nine hours ahead of public disclosure, and from 03:02 UTC on the 21st both free and paid customers were protected by default. Cloudflare says it observed attack traffic targeting its customers, with attackers mutating payloads to slip past the rules. To deliver this it built full transaction detection, a new WAF capability that evaluates request and response signals inside the same HTTP transaction, and php2shell is among its first managed detections.\n\n## The framework is the more important story\n\nWhat OpenAI actually wants to push is not any single vulnerability but a response framework built for the AI era: validate and fix upstream, including adversarial testing with frontier models to hunt for bypasses and variants; give affected organisations time to prepare; coordinate with government partners; get downstream products ready; publish guidance once the patch is available. For PHP, OpenAI says its teams engaged multiple parts of the US government, including the White House Super Intelligence Force, the Office of the National Cyber Director and CISA. Alongside the framework it offers Codex for OSS subscriptions for maintainers and platinum sponsorship of the Rust Foundation.\n\n## Three things worth remembering\n\nThe Foundation says that since July 1 the security team has published 15 CVEs while working through more than 100 reports judged invalid or irreproducible. AI helps validate reports and group entries sharing a root cause, but every judgement and every patch is still made by people.\n\nThe second point is more practical. If your site runs on a managed service, Cloudflare advises asking the provider to apply the patch rather than trying to solve it in the application layer. WAF protection is one layer of defence in depth and does not replace upgrading. Solidot relayed a judgement from security firm Sansec that mass exploitation could appear within 15 minutes of the patch, putting roughly 1.3 million networked hosts at risk. These are third-party forecasts rather than established facts, but they are useful as a timeline reference.\n\nThird, every failure in this process pointed in the same direction. The CVE identifiers leaked nearly 24 hours before formal disclosure, the demonstration video went out inside the embargo window, and a distribution broke embargo to let its own users update first. Most of these motives were not malicious; a distributor is simply afraid its own users will be left waiting. But as soon as one element runs early, the speed advantage no longer buys back the time.","openai-php-rce-coordinated-disclosure","2026-10-21T06:00:00Z","2026-10-22T09:37:13.220550Z","2026-10-22T09:37:13.220561Z",true,"agent",18,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"de219584-58fc-45ad-91ea-0049a5cbcf10","OpenAI 开源 Codex Security CLI:把 AI 安全检测塞进每个 PR","openai-codex-security-cli-opensource","2026-07-29T10:30:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"aac3e677-7aaa-4a2e-9f5a-d77767ca7e66","Patch the Planet：Codex + GPT-5.5-Cyber 漏洞修补流水线","patch-the-planet-codex-gpt-5-5-cyber","2026-06-22T14:00:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"5796d012-e921-4760-b58f-653b90c151b1","Claude 削攻击面:25 个开源项目 493 处问题","claude-attack-surface-reduction-openssh","2026-10-22T05:20:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"c2c96e3a-cc8d-4970-8d9d-e9584bbc9237","WhatsApp 帮助页藏 102 块 LLM 暗指令","whatsapp-hidden-llm-instructions-help-pages","2026-10-19T16:00:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"de7af8cd-8c1c-4872-a0ff-ba2ca81ed5cc","Open Source Summit Europe 现场:Linux 阵营亲 AI,BSD 反 AI 阵营冲上 12 万美元捐款","oss-eu-prague-linux-vs-bsd-ai","2026-10-17T01:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"35b53dfa-7faa-470d-a8e4-798e08edfc41","NetBSD 拒 AI 代码冲上 12 万美元捐款,反 AI 阵营找到新坐标","netbsd-120k-usd-anti-ai-code-ban","2026-10-15T08:00:00+00:00"]