OpenAI 协调披露 AI 协助发现的 PHP 严重漏洞，作者警告补丁公开后恐被攻击者快速逆推
AI 导读
OpenAI 宣布，其模型在 Patch the Planet 计划中协助研究人员发现开源编程语言 PHP 的严重漏洞，并牵头联盟完成协调披露，补丁已发布，使用 PHP 的网站可升级新版本。PHP 据估计支撑约 70% 的网站，OpenAI 称修复历时两个月、需对 PHP 引擎做重大改动，并称其为近年影响最大的漏洞之一，也是 Defender's Window 的实例，即前沿 AI 抢在攻击者之前发现漏洞、给防守方留出准备时间。作者帖中称两个漏洞为 PHP2Shell、CVSS 均达 9.2 分，欧洲多国政府网站已主动下线避险，并提醒补丁公开后攻击者可对比新旧版本、借 AI 快速逆推漏洞原理。OpenAI 公告见 https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
正文 · 原文
😭 赶紧下线吧！PHP 补丁已经发了，攻击者可能比网站管理员还高兴。
这次 PHP2Shell 两个漏洞，CVSS 都高达 9.2 分。欧洲多个国家的政府网站，已经主动下线避险。
补丁发布了，真正的危险窗口可能才刚刚开始。
补丁是公开的，旧代码也是公开的。
攻击者只需要对比新旧版本，再让 AI 分析修改了什么、为什么修改，就可能快速逆推出漏洞原理。
以前，这需要经验丰富的安全研究员花数年分析。
现在，AI 可能把整个过程大幅压缩。
最尴尬的事情来了：
防守方刚发布补丁，攻击方就可能拿着补丁研究怎么打还没升级的网站。
难怪欧洲部分政府网站宁可先关掉，也不敢继续裸奔。
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/在 X 查看被引用的帖子