从 PHP2Shell 事件看前沿模型如何缩短漏洞发现到利用的间隔
PHP2Shell 安全事件表明，前沿大模型能够将存在数十年的深层漏洞组合并转化为实际攻击，显著缩短了漏洞发现到利用的间隔。文章指出，随着模型能力普及，维护老旧系统和开源项目的安全将面临更大挑战。
- Explore Skills
View all * Data Engineering * Data Warehouse * SQL * Apache Spark * Microsoft SQL Server * MySQL * Kafka * Data Lake * Streaming & Messaging * NoSQL Databases * Relational Databases
View all * Data Science * Pandas * R * MATLAB * SAS * D3 * Power BI * Tableau * Statistics * Exploratory Data Analysis * Data Visualization
View all * AI & ML * Generative AI * Machine Learning * Artificial Intelligence (AI) * Deep Learning * Reinforcement Learning * Natural Language Processing * TensorFlow * Scikit-Learn * Hyperparameter Tuning * MLOps
View all * Programming Languages * Java * JavaScript * Spring * Python * Go * C# * C++ * C * Swift * Rust * Functional Programming
View all * Software Architecture * Object-Oriented * Distributed Systems * Domain-Driven Design * Architectural Patterns
View all * IT/Ops * Kubernetes * Docker * GitHub * Terraform * Continuous Delivery * Continuous Integration * Database Administration * Computer Networking * Operating Systems * IT Certifications
View all * Security * Network Security * Application Security * Incident Response * Zero Trust Model * Disaster Recovery * Penetration Testing / Ethical Hacking * Governance * Malware * Security Architecture * Security Engineering * Security Certifications
View all * Design * Web Design * Graphic Design * Interaction Design * Film & Video * User Experience (UX) * Design Process * Design Tools
View all * Business * Agile * Project Management * Product Management * Marketing * Human Resources * Finance * Team Management * Business Strategy * Digital Transformation * Organizational Leadership
View all * Soft Skills * Professional Communication * Emotional Intelligence * Presentation Skills * Innovation * Critical Thinking * Public Speaking * Collaboration * Personal Productivity * Confidence / Motivation
Platform
Search for books, courses, events, and more
- Explore Skills
Explore Skills
* Cloud Computing
Cloud Computing
* [Microsoft Azure](https://oreilly.com/search/skills/microsoft-azure/)
* [Amazon Web Services (AWS)](https://oreilly.com/search/skills/amazon-web-services-aws/)
* [Google Cloud](https://oreilly.com/search/skills/google-cloud/)
* [Cloud Migration](https://oreilly.com/search/skills/cloud-migration/)
* [Cloud Deployment](https://oreilly.com/search/skills/cloud-deployment/)
* [Cloud Platforms](https://oreilly.com/search/skills/cloud-platforms/)
Back
* Data Engineering
Data Engineering
* [Data Warehouse](https://oreilly.com/search/skills/data-warehouse/)
* [SQL](https://oreilly.com/search/skills/sql/)
* [Apache Spark](https://oreilly.com/search/skills/apache-spark/)
* [Microsoft SQL Server](https://oreilly.com/search/skills/microsoft-sql-server/)
* [MySQL](https://oreilly.com/search/skills/mysql/)
* [Kafka](https://oreilly.com/search/skills/kafka/)
* [Data Lake](https://oreilly.com/search/skills/data-lake/)
* [Streaming & Messaging](https://oreilly.com/search/skills/streaming-messaging/)
* [NoSQL Databases](https://oreilly.com/search/skills/nosql-databases/)
* [Relational Databases](https://oreilly.com/search/skills/relational-databases/)
Back
* Data Science
Data Science
* [Pandas](https://oreilly.com/search/topics/pandas/)
* [R](https://oreilly.com/search/topics/r/)
* [MATLAB](https://oreilly.com/search/topics/matlab/)
* [SAS](https://oreilly.com/search/topics/sas/)
* [D3](https://oreilly.com/search/topics/d3/)
* [Power BI](https://oreilly.com/search/topics/power-bi/)
* [Tableau](https://oreilly.com/search/topics/tableau/)
* [Statistics](https://oreilly.com/search/topics/statistics/)
* [Exploratory Data Analysis](https://oreilly.com/search/topics/exploratory-data-analysis/)
* [Data Visualization](https://oreilly.com/search/topics/data-visualization/)
Back
* AI & ML
AI & ML
* [Generative AI](https://oreilly.com/search/skills/generative-ai/)
* [Machine Learning](https://oreilly.com/search/skills/machine-learning/)
* [Artificial Intelligence (AI)](https://oreilly.com/search/skills/artificial-intelligence-ai/)
* [Deep Learning](https://oreilly.com/search/skills/deep-learning/)
* [Reinforcement Learning](https://oreilly.com/search/skills/reinforcement-learning/)
* [Natural Language Processing](https://oreilly.com/search/skills/natural-language-processing/)
* [TensorFlow](https://oreilly.com/search/skills/tensorflow/)
* [Scikit-Learn](https://oreilly.com/search/skills/scikit-learn/)
* [Hyperparameter Tuning](https://oreilly.com/search/skills/hyperparameter-tuning/)
* [MLOps](https://oreilly.com/search/skills/mlops/)
Back
* Programming Languages
Programming Languages
* [Java](https://oreilly.com/search/skills/java/)
* [JavaScript](https://oreilly.com/search/skills/javascript/)
* [Spring](https://oreilly.com/search/skills/spring/)
* [Python](https://oreilly.com/search/skills/python/)
* [Go](https://oreilly.com/search/skills/go/)
* [C#](https://oreilly.com/search/skills/c-sharp/)
* [C++](https://oreilly.com/search/skills/c-plus-plus/)
* [C](https://oreilly.com/search/skills/c/)
* [Swift](https://oreilly.com/search/skills/swift/)
* [Rust](https://oreilly.com/search/skills/rust/)
* [Functional Programming](https://oreilly.com/search/skills/functional-programming/)
Back
* Software Architecture
Software Architecture
* [Object-Oriented](https://oreilly.com/search/skills/object-oriented-architecture/)
* [Distributed Systems](https://oreilly.com/search/skills/distributed-systems/)
* [Domain-Driven Design](https://oreilly.com/search/skills/domain-driven-design/)
* [Architectural Patterns](https://oreilly.com/search/skills/architectural-patterns/)
Back
* IT/Ops
IT/Ops
* [Kubernetes](https://oreilly.com/search/topics/kubernetes/)
* [Docker](https://oreilly.com/search/topics/docker/)
* [GitHub](https://oreilly.com/search/topics/github/)
* [Terraform](https://oreilly.com/search/topics/terraform/)
* [Continuous Delivery](https://oreilly.com/search/topics/continuous-delivery/)
* [Continuous Integration](https://oreilly.com/search/topics/continuous-integration/)
* [Database Administration](https://oreilly.com/search/topics/database-administration/)
* [Computer Networking](https://oreilly.com/search/topics/computer-networking/)
* [Operating Systems](https://oreilly.com/search/topics/operating-systems/)
* [IT Certifications](https://oreilly.com/search/topics/it-certifications/)
Back
* Security
Security
* [Network Security](https://oreilly.com/search/skills/network-security/)
* [Application Security](https://oreilly.com/search/skills/application-security/)
* [Incident Response](https://oreilly.com/search/skills/incident-response/)
* [Zero Trust Model](https://oreilly.com/search/skills/zero-trust-model/)
* [Disaster Recovery](https://oreilly.com/search/skills/disaster-recovery/)
* [Penetration Testing / Ethical Hacking](https://oreilly.com/search/skills/penetration-testing-ethical-hacking/)
* [Governance](https://oreilly.com/search/skills/governance/)
* [Malware](https://oreilly.com/search/skills/malware/)
* [Security Architecture](https://oreilly.com/search/skills/security-architecture/)
* [Security Engineering](https://oreilly.com/search/skills/security-engineering/)
* [Security Certifications](https://oreilly.com/search/skills/security-certifications/)
Back
* Design
Design
* [Web Design](https://oreilly.com/search/skills/web-design/)
* [Graphic Design](https://oreilly.com/search/skills/graphic-design/)
* [Interaction Design](https://oreilly.com/search/skills/interaction-design/)
* [Film & Video](https://oreilly.com/search/skills/film-video/)
* [User Experience (UX)](https://oreilly.com/search/skills/user-experience-ux/)
* [Design Process](https://oreilly.com/search/skills/design-process/)
* [Design Tools](https://oreilly.com/search/skills/design-tools/)
Back
* Business
Business
* [Agile](https://oreilly.com/search/skills/agile/)
* [Project Management](https://oreilly.com/search/skills/project-management/)
* [Product Management](https://oreilly.com/search/skills/product-management/)
* [Marketing](https://oreilly.com/search/skills/marketing/)
* [Human Resources](https://oreilly.com/search/skills/human-resources/)
* [Finance](https://oreilly.com/search/skills/finance/)
* [Team Management](https://oreilly.com/search/skills/team-management/)
* [Business Strategy](https://oreilly.com/search/skills/business-strategy/)
* [Digital Transformation](https://oreilly.com/search/skills/digital-transformation/)
* [Organizational Leadership](https://oreilly.com/search/skills/organizational-leadership/)
Back
* Soft Skills
Soft Skills
* [Professional Communication](https://oreilly.com/search/skills/professional-communication/)
* [Emotional Intelligence](https://oreilly.com/search/skills/emotional-intelligence/)
* [Presentation Skills](https://oreilly.com/search/skills/presentation-skills/)
* [Innovation](https://oreilly.com/search/skills/innovation/)
* [Critical Thinking](https://oreilly.com/search/skills/critical-thinking/)
* [Public Speaking](https://oreilly.com/search/skills/public-speaking/)
* [Collaboration](https://oreilly.com/search/skills/collaboration/)
* [Personal Productivity](https://oreilly.com/search/skills/personal-productivity/)
* [Confidence / Motivation](https://oreilly.com/search/skills/confidence-motivation/)
Back
Back
- Platform
Platform
* [All features](https://oreilly.com/online-learning/features.html)
* [Verifiable skills](https://oreilly.com/online-learning/verifiable-skills.html)
* [Academies](https://oreilly.com/online-learning/academies.html)
* [Courses](https://oreilly.com/online-learning/courses.html)
* [Certifications](https://oreilly.com/online-learning/feature-certification.html)
* [Interactive learning](https://oreilly.com/online-learning/intro-interactive-learning.html)
* [Live events](https://oreilly.com/online-learning/live-events.html)
* [Virtual conferences](https://oreilly.com/products/superstreams.html)
* [Answers](https://oreilly.com/online-learning/feature-answers.html)
* [Insights reporting](https://oreilly.com/online-learning/insights-dashboard.html)
Back
Search for books, courses, events, and more
Toggle dark mode
AI & MLBusinessDataInnovationResearchSecurity
Try the O’Reilly learning platform
With the O’Reilly learning platform, you get the resources and guidance to keep your skills sharp and stay ahead. Try it free for up to 14 days.
Try a course for free
Join a live online event on the O’Reilly platform to learn from the experts shaping tech.
Get the Radar Trends newsletter
Your email
Country
Subscribe
Please read our privacy policy.
Thank you for subscribing to the O’Reilly Radar Trends to Watch newsletter.
The PHP Incident
An inflection point for security
By Mike LoukidesOctober 28, 2026 • 6 minute read
Share
CloseLinkedInXFacebookThreadsBlueskyReddit
The PHP security incident is now (almost) old news. The timeline looks something like this: In late August, Wiz Research discovered two serious remote code execution vulnerabilities in PHP called PHP2Shell. They reported the vulnerabilities to the PHP team on August 24, which started working on fixes on September 21. Amazon apparently detected PHP2Shell in the wild on October 17 (four days prior to disclosure). On October 20, details of the two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were leaked prematurely. The next day, October 21, the PHP team released patches.
If that were the end of the story, it wouldn’t be notable. But the problem goes a lot deeper. Although PHP is no longer fashionable, it runs a huge portion of the public internet. WordPress, Drupal, and Wikimedia run on top of PHP, and people who build on top of these tools are understandably not interested in chasing the latest hot technology. “Choose Boring Technology” is one of my favorite technical essays, and PHP is nothing if not boring. It’s well known and understood, and replacing something so widely used subjects you to a steep learning curve and new bugs and vulnerabilities.
One problem is that PHP has a long history. According to Wiz, the vulnerabilities are present in versions going back to PHP 5.4. The PHP Foundation has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and said that all instances of PHP need to be updated to one of those releases. Sites that can’t be updated should be taken offline and isolated. Upgrading an ancient PHP installation is a task that’s likely to fall on organizations least capable of undertaking it. There are plenty of ancient WordPress installations that haven’t been updated in years. There were so many fires to put out, and PHP pretty much “just worked”; running an old version wasn’t causing problems, and with so much else to do, why ask for trouble? Unfortunately, choosing boring technology doesn’t mean ignoring updates. And those who decided not to ask for trouble are now in plenty of trouble.
This situation demonstrates the power of the latest foundation models to uncover vulnerabilities. Wiz used Wiz Atlas (its own model), Gemini 4 Argon, and GPT-5.6 Sol to discover the vulnerability, which isn’t a single bug but a combination of several bugs that have been present for years but were obscure enough and apparently harmless enough to escape detection or repair. As Wiz says,
The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
That’s the new frontier in security: finding ways to exploit chains of minor, unfixed, and sometimes undiscovered bugs in novel ways. Wiz was working responsibly with the PHP team to repair the vulnerability. The implications of this, however, are far broader than the fix to PHP, or even the thousands of PHP sites that need upgrades and are now vulnerable to attack. This incident shows dramatically how the gap between the discovery of a vulnerability and its exploitation has dropped. Since exploitation began before the RCEs were prematurely leaked, it makes sense to assume that some other organization had access to models capable of discovering the vulnerability. Gemini 4 Argon and GPT-5.6 Sol are publicly available, though with guardrails that limit their usefulness for security research. I’m willing to assume that Wiz had access to the unrestricted version, but I doubt that the PHP team did. There are certainly other models, including open-weight models, that could be used to find vulnerabilities. Regardless of your stance on restricting model capabilities (I think those limitations are more damaging than helpful), it’s clear that Pandora’s box has been opened. No amount of wishful thinking will undo that.
It’s also clear that we—and I mean all of us—rely on a lot of legacy software that isn’t under our control and that no doubt has multiple flaws that can be rolled up into severe vulnerabilities, which aren’t likely to be updated or patched. A vulnerability in the Brotli compression algorithm was just discovered; .NET, PHP, Node.js, and other widely used packages are affected. That strange site where you created an account to buy a clever present that wasn’t available anywhere else—what software is it running, and do they stay up-to-date with patches? Accounts like that can easily leak information. Maybe it’s not running PHP but an equally ancient version of Ruby on Rails, Python’s Django, or Java Server Pages. At least those are still maintained; there are plenty of web frameworks that have been abandoned, and I’m willing to bet that some of them are still in use. Why replace something that works? Because if you don’t, you will eventually be bitten. Using software that’s no longer maintained may give you some security-by-obscurity, but that’s a losing proposition.
Many older open source projects suffer because there are few maintainers. If you look at the timeline carefully, there’s a monthlong gap between the time Wiz reported the vulnerability and the time the PHP team started working with Wiz to fix it. Does that month represent the time this vulnerability took to rise to the top of the queue, as PHP’s security team fought off a horde of sloppy reports? And PHP is in better shape than most projects. There are many open source projects that only have one or two maintainers, and those maintainers are drowning in AI-generated pull requests. That problem obviously becomes much worse when dealing with a complex vulnerability; the maintainers don’t have the time or the access to unrestricted frontier models, let alone the funds to pay for access to the models.
It will be weeks or months before we know how much damage PHP2Shell has done. We don’t know what the costs will be to sites that won’t or can’t update. The PHP Foundation is lucky to have a dedicated security team that was able to provide patches a day after the vulnerability was prematurely announced. Beyond PHP, we have to realize that PHP2Shell gives us a realistic look into a future in which developers and maintainers struggle to maintain software that has been compromised by exploits chaining together flaws that have been latent for many years. As someone somewhere said on the internet recently, “It’s embarrassing how much bad software we’ve written over the years.” Yes. We’re at an inflection point, and we’re starting to pay the price.
Post topics: AI & ML•Software Architecture•Web
Explore related articles
article AI & ML ## The Agentic Data Science Playbook By undefined | undefined
article AI & ML ## Human Judgment Doesn’t Leave the Software Factory, It Relocates By undefined | undefined
Follow us
About O'Reilly
- Teach/Write/Train
- Careers
- O'Reilly News
- Media Coverage
- Community Partners
- Affiliate Program
- Diversity
- Content Sponsorship
Support
International
Download the O'Reilly App
Take O'Reilly with you and learn anywhere, anytime on your phone and tablet.
Do not sell or share my personal information.
© 2026, O'Reilly Media, Inc. All trademarks and registered trademarks appearing on oreilly.com are the property of their respective owners.
Privacy Preference Center
When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
More information
Enable All
Manage Consent Preferences
Strictly Necessary Cookies
Always Active
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
View Vendor Details
Performance Cookies
Always Active
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
View Vendor Details
Functional Cookies
Always Active
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
View Vendor Details
Targeting Cookies
Always Active
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
View Vendor Details
Vendors List
Clear
- checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
Reject All Confirm
来源：O'Reilly Radar · oreilly.com