Abstract:
Without even using an account or password, hackers can make the website server take orders from them! Yesterday OpenAI disclosed a thrilling behind-the-scenes operation: GPT-5.6 Sol dug out two fatal vulnerabilities in the PHP language used by 70% of the world's websites.
Once exploited, the attacker
can directly make the server execute malicious code without having to enter the account password.
In fact, even the Dutch National Internet Security Agency, which usually teaches others how to prevent hackers, the first reaction after receiving the news was to quickly
close its own official website
!In order to plug the hole, OpenAI and PHP maintainers
worked secretly for two months
, not hesitate to overturn and start over,Even the memory management mechanism of the PHP engine has been changed
.However, after keeping it secret for two months, it completely collapsed in the
last 48 hours
——Vulnerability information was leaked first, forcing the patch to be launched one day ahead of schedule; then the attack demonstration video accidentally leaked out, and the repair image was released ahead of schedule.
Before webmasters around the world could react and patch it, the first wave of real attacks was already on the way.
What’s even more chilling is that OpenAI also buried an Easter egg: these two are just appetizers, and several other major vulnerabilities are still being queued for repair...
This time PHP explodes, here are three things to understand:
Two high-risk vulnerabilities:
PHP is a commonly used backend language for websites. In affected deployments, an attacker could allow the server to execute malicious code without logging in.GPT participates in finding holes:
Calif discovered the vulnerability with the help of GPT, and Wiz also discovered it independently; PHP maintainers led the fix, and OpenAI coordinated all parties.The patch has been released:
Website operators need to upgrade PHP, and temporary protection cannot replace patches.PHP suddenly exploded, and the network security agency shut down the site first
In this secret emergency repair, even the organization responsible for preventing hackers had to shut down the website to avoid danger.
The official website is offline before the patch arrives.
On October 21, the Dutch National Cyber Security Center NCSC chose to shut down the site first and wait for repairs.
It is not the only one that has been shut down. The recruitment website of the Dutch judicial system and the website of judicial training institutions have also suspended services, and even the document mailbox for transmitting court trial information to reporters has been temporarily closed.
The Ministry of Finance of Japan also stopped some content and services on the official website and urgently inspected the server and installed and repaired it.
The two PHP engine vulnerabilities that caused the website to shut down are collectively called PHP2Shell.
The CVSS risk score reached 9.2 points, out of 10 points
.
One of the most dangerous consequences is called
remote code execution, abbreviated as
RCE
. A website that is supposed to only handle requests from visitors may start executing code specified by the attacker.Wiz used the latest WordPress, Drupal, and Joomla images to build a test environment, reproduced a remote attack without logging in, and verified the attack path of reading passwords, tokens, and API keys from memory.
Even, in some Apache and mod_php deployments, the attack can occur before the website's own program is started.
Even if the page only writes a line of "Hello World", you may still be infected.
The trouble is, there are too many websites using PHP.
69.3% of the websites that W3Techs can recognize the server language use PHP.
There is a problem with the underlying engine, and a large number of websites have to be checked and upgraded.GPT has made great contributions
Catch an entire category from one vulnerability
Going back to July 30, Calif researcher Ryan Austin began auditing PHP. He participated in OpenAI's Patch the Planet program, which uses AI to help open source projects find and repair holes.
By August 1, multiple remote attack paths had been discovered.
As early as 2004, PHP's memory limit mechanism was discovered to have a remote attack vulnerability. Ryan used GPT-5.6 Sol as an entry point to check whether similar problems are still hidden in existing code.
The program processes the request and temporarily puts the data into memory. PHP assigns a quota to each request, and the processing will be interrupted when it is used up. This situation is called
memory exhaustion, that is,
OOM
.In an attack path disclosed by Calif,
less than 8MiB of request data is enough to exhaust PHP's default 128MiB memory quota during processing.
After a small request enters PHP, it will be split into a large number of records, each of which takes up additional memory. Attackers use this layer of amplification to allow the program to exhaust its credit at a specific step.
According to PHP rules, the operation should be interrupted at this time and transferred to error reporting and cleaning.
At this moment, the data may only be half filled in.
The model discovered a dangerous sequence in the hash table that stores data inside PHP: when adding a new record,
first add one to the number of records, then apply for memory and fill in the content
.
If the quota is exhausted when applying for memory, the program will jump. The new record hasn't been filled in yet, but the count has already been added.
The cleanup program checks the count and uses the unprepared memory as a valid record.
It is equivalent to a row in the form that has not been filled out yet and has been used as a complete record.
To turn this kind of error into a remote attack, it is necessary to arrange relevant memory contents and meet specific operating conditions. Researchers have caused programs to execute attacker-specified code in affected deployments.
The researchers didn't stop at the hole. They asked the model to
write the newly discovered error pattern into SKILL.md, an audit guide that can be used repeatedly
, and then follow the same clues to investigate.After this investigation, Agent found another problem in the code responsible for recording the progress of file upload.
A request ends abnormally,
the memory is released, but the program that handles the request still retains the old address
. When it receives the next request, it may use this address to read the expired memory.This is
use after release, also called UAF
. It is equivalent to a registration that has been invalidated, but the program is still looking for data according to the old address, and that memory may have been reallocated.On the other hand, Wiz also independently found two vulnerabilities. Once the PHP version changes or the operating environment changes, the original attack may become ineffective, and the model must be analyzed and crashed, adjusted and verified.
Wiz researcher Sagi Tzadik wrote on X:
"
AI
Does most of the work here. ”
Perform surgery on the PHP engine
Two months of secret repairs
It took a few days to find the attack path, but it took two months to prepare for the repair.
This time, OpenAI took the lead in coordinating the fix, and PHP maintainers led the fix. However, two vulnerabilities affect the engine's memory management and error handling, blocking the immediate attack path, and similar problems may arise elsewhere. If the underlying layer is overhauled, it is necessary to ensure that old programs and extensions can still run.
The PHP Foundation said the team was coordinating day and night, even on weekends. Patches need to be tested on multiple versions, and must be packaged by publishers and protected by security vendors.
Eventually, PHP even changed the timing of stopping work.
The patched PHP has two memory limits.
soft limit reached
, wait until the program reaches a safe location before processing to avoid leaving half-finished data; touching a higherhard limit
, let the process exit and prevent the dangerous state from being continued to be used.Secrets were leaked one after another in the last 48 hours, and the attack came first
All parties originally agreed to release it at 10pm on October 22nd.
But around 11pm on the 20th, two vulnerability numbers suddenly circulated on the Internet, mixed with the wrong release time and a perfect score of 10. At this time, it was less than 48 hours before the original release.
At 3:30 in the morning on the 21st, the PHP team issued a notice in advance,
moving the official release forward by a full 24 hours
.But just because the notification is sent, it doesn’t mean that the update can be installed. Publishers are still packaging, and if they are advanced, users will know that they are in danger, but will not get updates that are easy to install.
The trailer was released about half an hour ago, and the attack demonstration video was also missing.
The PHP Foundation reviewed and stated that Calif mistakenly sent an attack demonstration. The video was quickly deleted, but copies have been circulated.
On the afternoon of the 21st, even the repaired build image was released in advance. After Chainguard releases these images, the outside world can compare the old and new codes and infer where the vulnerabilities are.
At 3:43 pm on the same day, Cloudflare Chief Technology Officer Dane Knecht posted on X:
Early attacks have been seen.
When he posted, the patch was not scheduled to be released until 10 o'clock that night.
The attack has come, and there are still more than six hours to go.
Cloudflare later disclosed that attackers were already changing requests to try to bypass protection rules.
Cloudflare has deployed protection to free and paid customers using its Web Application Firewall, but Dane emphasized that
this is only a temporary measure and must be installed as patches come out
.On the evening of the 21st,
PHP8.5.12, 8.4.27, 8.3.36 and 8.2.35
Finally released. The PHP team has also prepared minimal source code fixes for 7.4, 8.0 and 8.1 for publishers and long-term support services to produce update packages.
OpenAI preview
More major vulnerabilities are yet to come
At 0:35 on the 22nd, OpenAI released another Codex checking skill to help website operators check the PHP version to determine whether it may be affected.
It checks the PHP version and cannot complete the upgrade for the website; if it cannot even check the version, it cannot be deemed safe based on this.
And OpenAI has already announced:
PHP is just one of the many major vulnerabilities that the team has discovered and is fixing.
This type of discovery is expected to increase significantly in the coming months!
Comments