Cloudflare 紧急拦截 PHP 核弹级漏洞
推荐指数 42.0 NO. 019 · 2026.10.22
发布2026/10/21Score99Comments15
简介
PHP 曝出新漏洞 php2shell（CVE-2026-109618/109619），影响 PHP 5.4+ 所有版本，可导致 RCE 和数据泄露。Cloudflare 提前 9 小时部署 WAF 规则，与 OpenAI、Wiz 等协调完成全球防护。
编辑判断
这个漏洞的杀伤力在于"所有 PHP 5.4+ 服务器"的覆盖面和 HTTP 层面的攻击向量，意味着大量老旧系统无需应用层漏洞就能被击穿。Cloudflare 能提前 9 小时部署，说明漏洞细节在披露前已在安全圈内小范围流通，这种"协调披露+基础设施级防护"的模式正在成为主流。
对自托管 PHP 应用的团队来说，WAF 规则是应急绷带而非根治方案，核心动作仍是升级 PHP 版本或打补丁。值得关注的是 OpenAI 出现在披露方名单里，暗示这个漏洞可能已被用于针对 AI 基础设施的攻击，做 AI 应用托管的创业者需要排查自己的 PHP 依赖。
社区反馈
意见分歧 13 条评论
核心争论：安全危机该靠云厂商应急防护还是从根本上重构软件安全
As big a fan of open software as I am, the combinations of open-weight LLM models that are capable of e2e cyber-penetration (even by actors that might just put in the compute and prompt it: "make me money") and the current mitigations that let those entities, that already hold too much data and powe
https://www.basis.ai/blog/ship-your-interpreters/ This is the counter. Make your software provably correct. Then you don't need gatekeepers nor to fear any attackers.
The invention of the locomotive was also the invention of the train wreck. V. The disaster is not just "open weight" model penetrating everything, its is that we have built the whole world around an IT revolution that never really reached maturity and became secure. The chickens are just coming home