Critical Flaw in PHP Knocks Major Websites Offline

Major websites and government portals have been forced offline after researchers discovered two severe security vulnerabilities in PHP, the programming language that underpins nearly 70 percent of the web. The flaws prompted services ranging from Wikipedia and DeviantArt to Finnish and Dutch government agencies to temporarily disable their platforms or rush out emergency updates. Cybersecurity authorities in the United States and the United Kingdom even advised organizations to disconnect affected systems if an immediate fix was not feasible.

在研究人員發現支撐近70%網路世界的程式語言PHP存在兩項嚴重安全性漏洞後，眾多主流網站與政府門戶網站被迫停止運作。這些瑕疵促使從維基百科（Wikipedia）、DeviantArt到芬蘭與荷蘭政府機構等服務，紛紛暫時停用其平台或緊急推出修復更新。美國與英國的網路安全主管機關甚至建議各機構，若無法立即修復，應將受影響的系統斷網。

prompted services ranging from= 結合「prompt sb to do（促使某人做某事）」與「ranging from A to B（範圍涵蓋從A到B）」，用來描述事件迫使廣泛的組織採取應變措施。rush out= 動詞片語，指極為緊急、迅速地推出或發布（更新、修正檔等）。

PHP runs on millions of web servers around the world, powering virtually every platform built on WordPress. According to the PHP Group, the newly uncovered vulnerabilities allow unauthenticated remote code execution, meaning attackers can run malicious code, alter page content, and access stored databases without an administrator password. The two weaknesses involve memory errors during request handling: one triggers when an out-of-memory interruption leads the system to treat invalid data as valid, while the other allows leftover request data to linger in server memory and corrupt subsequent user sessions.

PHP在全球數百萬台網路伺服器上運作，支撐著幾乎所有基於WordPress建構的平台。根據PHP Group的說法，新揭露的漏洞允許未經身分驗證的遠端代碼執行，這意味著攻擊者無需管理員密碼即可執行惡意代碼、竄改網頁內容並存取儲存的資料庫。這兩項弱點涉及請求處理期間的記憶體錯誤：其中一項觸發於記憶體不足中斷導致系統將無效資料視為有效資料，另一項則允許殘留的請求資料留在伺服器記憶體中，進而損壞後續的使用者工作階段。

leads the system to treat invalid data as valid= 由「lead [受詞] to [原形動詞]（導致……）」與「treat A as B（將A視為B）」構成，表示因果關係以及系統將無效資料誤當有效資料處理的行為。

Although the underlying code has existed in PHP for roughly twenty years, exploiting it previously required an exceptionally complex chain of steps at the edge of human ability. That barrier collapsed when researchers began using advanced artificial intelligence models. An AI security group called Calif identified one of the flaws using GPT-5.6 Sol, while the cybersecurity firm Wiz independently discovered the issues using AI tools. Experts warned that the same machine intelligence that uncovered the bugs also makes it far easier for attackers to weaponize them against vulnerable servers.

儘管底層代碼已在PHP中存在約二十年，但過去要利用該漏洞需要一連串極其複雜、逼近人類能力極限的步驟。然而，當研究人員開始使用先進的人工智慧模型時，這道屏障瓦解了。名為Calif的AI資安團隊利用GPT-5.6 Sol識別出其中一個漏洞，而資安公司Wiz也透過AI工具獨立發現了這些問題。專家警告，揭露出這些錯誤的同一套機器智慧，也使得攻擊者將其武器化並用以對付脆弱伺服器變得容易得多。

at the edge of human ability= 慣用描述片語，形容逼近或達到人類能力所能做到的極限邊緣。

With Cloudflare already observing initial attacks, cybersecurity specialists describe the incident as one of the most critical software vulnerabilities in recent history. While everyday internet users cannot patch web servers directly, website administrators are being urged to verify their software versions immediately. Hosting providers noted that older installations, including PHP 8.1 and earlier, will not receive official security fixes, leaving website owners with little choice but to upgrade to supported releases or shut down vulnerable sites until patches are applied.

隨著Cloudflare已觀察到初步攻擊，網路安全專家將此事件描述為近代歷史上最嚴重的軟體漏洞之一。雖然一般網路使用者無法直接修補網路伺服器，但網站管理員被敦促立即核對其軟體版本。主機託管商指出，包括PHP 8.1及更早版本在內的較舊安裝將不會收到官方安全性修復，這使得網站擁有者除了升級至受支援的版本，或在套用修補程式前關閉有漏洞的網站之外，幾乎別無選擇。

leaving website owners with little choice but to= 「leave sb with little choice but to do」表示迫使某人除了採取特定行動之外，幾乎別無其他選擇。

單字	意思
feasible	在現有的條件和資源下可行、做得到的。
linger	（感覺、氣味、記憶等）持續存在，久久不散；（問題、影響等）遲遲未消退。
subsequent	接下來的；隨後的；之後發生的
underpins	從下方支撐或加固，使建築物、結構等更加穩固。
weaponize	將某物改造成武器，或把某物當作武器使用；亦指把原本用於其他目的的工具或系統，轉作攻擊、監控等用途。

Critical Flaw in PHP Knocks Major Websites Offline

學習筆記

文法整理

詞彙整理

延伸學習

練習

句型	意思
prompted services ranging from	結合「prompt sb to do（促使某人做某事）」與「ranging from A to B（範圍涵蓋從A到B）」，用來描述事件迫使廣泛的組織採取應變措施。
rush out	動詞片語，指極為緊急、迅速地推出或發布（更新、修正檔等）。
leads the system to treat invalid data as valid	由「lead [受詞] to [原形動詞]（導致……）」與「treat A as B（將A視為B）」構成，表示因果關係以及系統將無效資料誤當有效資料處理的行為。
at the edge of human ability	慣用描述片語，形容逼近或達到人類能力所能做到的極限邊緣。
leaving website owners with little choice but to	「leave sb with little choice but to do」表示迫使某人除了採取特定行動之外，幾乎別無其他選擇。