欢迎来到Kernel Panic，由Lily Hay Newman和Matt Burgess从隐私和数字安全的新世界里制作的每周通讯。 每周在收件箱里收到这份通讯登记到这里
由于安全小组和网络管理员本周纷纷赶来补补新公开的PHPbug，犯罪黑客迅速试图利用野外的缺陷。 根据Cloudflare的分析，数百万的开采企图在公布脆弱性后的几小时内被击中——令人惊讶的是，由于广泛获得AI工具，使攻击者能够更容易地迅速利用缺陷。
目前大规模受害者接管和破坏的恶梦情景还没有出现。 PHP Foundation 称并未看到任何成功利用bug，然而，也许AI在本周的混乱中最有趣的作用是，先进的模型如何帮助研究人员发现对脆弱性的实际利用，这些脆弱性至少已经知道好几年了。 换言之，大赦国际帮助将历史脆弱性转变为当前的危机。
那么，我们是否都即将被一波数十年来不断推波助澜的严重脆弱性所困扰？
保安公司Calif的研究人员首先在8月初查明了PHP2Shell的弱点并创造了利用——部分使用前沿AI工具作为OpenAI的Patch the Planet方案的一部分，但也利用了人类专家对PHP、其动态及其弱点的了解。 2024年发现了一些根本问题，但被认为过于复杂，无法在当时加以利用。 在Calif发现后，OpenAI和Google所属的保安公司Wiz的研究人员利用AI工具独立地发现了PHP2Shell缺陷。
" PHP小组多年来一直知道这种脆弱性，但由于攻击者——至少不是人类——无法利用这种脆弱性，Wiz的安全研究员称 Sagi Tzadik没有加以解决。
没有软件是完美的。 即使是最关键，最有基础的数字工具也不可避免地存在缺陷，但AI模型不断扩大的能力使得分析并潜在地利用脆弱性的速度更快。 这给资源不足的IT团队，开发者，以及管理者带来更大的压力来跟上。 Microsoft的安保更新仅本月就有创纪录的1 453个安全漏洞。 与此同时，美国银行最近聘请了1000名顾问来弥补Anthropic神话中发现的缺陷。 然而，安全研究者强调，大赦国际最终并没有做任何新的工作，而是放大了现有的脆弱性发现和协调披露的动态。
称 Jake Williams是猎人战略研究与开发的副总裁，“但我认为这种低调的水果只有这么多。 也没什么比PHP更好的了。 大部分其他工具并没有通过设计接触互联网。
研究者也指出，即使有前沿模型，人工智能协助的黑客化的大多数例子也涉及人类专业知识。 正如最初发现PHP缺陷的卡利夫研究员Ryan Austin本周所写道，“没有任何模型能够简单地用简单的提示揭开`所有bug'。 至少暂时如此。”
简而言之，安全工程师和研究员尼尔斯·普罗沃斯·称(Niels Provos 称)，每个人都可以拨回自己的怪胎，至少可以拨回一点。 称担心AI发现大量历史错误，“现在，人们已经与大赦国际联系一年多，需要一支高技能的队伍来找到这一支队伍。 我想，我们将看看我是否完全错了，但我怀疑。”
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.
As security teams and web admins scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. Millions of exploitation attempts hit within hours of the vulnerabilities being published, according to analysis from Cloudflare—unsurprising given broad access to AI tools that can make it easier for attackers to quickly exploit flaws.
So far, the nightmare scenario of mass victim takeovers and breaches hasn’t come to pass. The PHP Foundation says it hasn’t seen any successful exploitation of the bugs, collectively dubbed PHP2Shell, and many publicly circulating potential exploits appear to be ineffective. However, perhaps the most interesting role of AI amid the chaos this week is how advanced models helped researchers uncover practical exploitations for the vulnerabilities, which were known about, at least in part, for years. In other words, AI helped turn historic vulnerability into a current crisis.
So are we all about to be walloped by a wave of critical vulnerabilities that have been kicking around for decades?
Researchers at security company Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August—partially using frontier AI tools as part of OpenAI’s Patch the Planet program, but also using expert human knowledge of PHP, its dynamics, and its weaknesses. Some of the underlying issues were identified in 2024 but were deemed too complex to exploit at the time. Following Calif’s discovery, researchers at OpenAI and the Google-owned security firm Wiz independently discovered PHP2Shell flaws using AI tools.
“The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed,” says Sagi Tzadik, a security researcher at Wiz.
No software is perfect. There are inevitably flaws in even the most critical, foundational digital tools, but the expanding capabilities of AI models have made it faster to analyze and potentially exploit vulnerabilities. This puts even more pressure on under-resourced IT teams, developers, and admins to keep up. Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone. Meanwhile, Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos. Security researchers emphasize, though, that AI is ultimately not doing anything new, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure.
“We'll definitely see more of these long-life bugs that are in every version of the software for the last decade or whatever,” says Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker. “But I think there’s only so much of this low-hanging fruit. There isn’t much else that has the specific reach of PHP. It’s a pretty wild attack surface—most other tools aren’t exposed to the internet by design.”
Researchers note, too, that even with frontier models, most examples of sophisticated AI-aided hacking also involve human expertise. As Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote this week, “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.”
In short, security engineer and researcher Niels Provos says, everyone can dial back their freak-outs, at least a bit. “To be honest, I am not really worried,” he says, about AI finding an overwhelming number of historic bugs that are newly exploitable—or new vulnerabilities that couldn’t have been practically exploited without AI. “People have now been looking with AI for over a year, and it required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it.”
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.