Dhaqdhaqaaq baahsan oo lagu isku dayay in laga faa'iideysto cilladaha PHP2Shell
Calif ayaa si qayb ah u isticmaashay qalabka AI ee OpenAI barnaamijka Patch the Planet markii ay heshay cilladaha
Kooxaha ammaanka iyo maamulayaasha websaytyada ayaa ku mashquulay in ay hagaajiyaan cillado PHP oo dhawaan la shaaciyay, iyadoo hawlgalo dembiilayaal ah ay isku dayeen in ay ka faa'iideystaan cilladahaas. Cloudflare ayaa sheegtay in malaayiin isku-day ah la sameeyay saacado gudahood ka dib markii cilladaha la daabacay.
Isku-dayo badan, laakiin ma jiro xaqiijin guul
Hay'adda PHP Foundation ayaa sheegtay in aanay weli arag wax isku-day ah oo si guul leh uga faa'iideystay cilladaha, kuwaas oo si wadajir ah loogu magacaabay PHP2Shell. Sidoo kale, qaar badan oo ka mid ah isku-dayada suurtagalka ah ee si cad loo faafiyay ayaa u muuqda kuwo aan waxtar lahayn.
AI iyo aqoonta bini'aadamka oo isku daray
Cilmi-baarayaasha shirkadda ammaanka ee Calif ayaa ahaa kuwii ugu horreeyay ee gartay cilladaha PHP2Shell oo sameeya isku-dayo horraantii Agoosto, iyagoo si qayb ah u isticmaalay qalabka AI ee casriga ah ee barnaamijka Patch the Planet ee OpenAI, iyo sidoo kale aqoonta khibradda leh ee bini'aadamka ee PHP. Qaar ka mid ah arrimaha asaasiga ah ayaa la gartay 2024, laakiin markaas waxaa loo arkay in ay aad u adag tahay in laga faa'iideysto.
Cillado qadiimi ah oo hadda la gaari karo
Sagi Tzadik, cilmi-baare ammaan oo ka tirsan Wiz, ayaa sheegay in cilladda ay kooxda PHP garanayeen sanado, laakiin maadaama aanay kuwa ku weeraraa — ugu yaraan bini'aadam — awoodin in ay ka faa'iideystaan, aan la xallin. Jake Williams oo ka tirsan Hunter Strategy ayaa sheegay in ay sii arki doonaan cillado qadiimi ah oo ku jira nooc kasta oo softweer ah, laakiin uu ku nuuxnuuxsaday in aanay badnayn cilladaha gaaraya heerka PHP.
Cloudflare recorded millions of exploitation attempts within hours, while the PHP Foundation says it has seen no successful exploitation of the PHP2Shell flaws.
Security teams and web administrators rushed to patch newly public PHP bugs this week as criminal hackers tried to exploit them in the wild. Cloudflare recorded millions of exploitation attempts within hours of publication, but the PHP Foundation says it has not seen any successful exploitation of the flaws, collectively called PHP2Shell.
AI Tools Helped Researchers Build Working Exploits
Researchers at the security company Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August, partly using frontier AI tools under OpenAI's Patch the Planet program and partly drawing on expert human knowledge of PHP. Some underlying issues were identified in 2024 but were deemed too complex to exploit at the time. OpenAI and the Google-owned security firm Wiz later independently discovered PHP2Shell flaws using AI tools.
A Known Flaw That Humans Could Not Leverage
Sagi Tzadik, a security researcher at Wiz, said the flaw had long been known to the PHP team. "The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed," he said. Many publicly circulating potential exploits appear to be ineffective, according to the reporting.
Researchers Urge Caution on AI-Driven Bug Discovery
Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote: "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now." Security engineer and researcher Niels Provos said: "To be honest, I am not really worried. People have now been looking with AI for over a year, and it required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it."
Ilaha iyo xuquuqda sawirka
Sawir: Wired Xigasho
