用 WordPress 架站的人注意！PHP 老漏洞讓攻擊者不用登入就能遠端執行程式

PHP 裡一組放了十幾年的記憶體漏洞，在前沿 AI 壓低門檻後變得打得進去，被讀出的記憶體裡可能有密碼、登入 token 與 API key。WordPress 官方這次不出 WordPress 更新，要更新的是跑網站的 PHP，站長可在後台網站健康狀態查 PHP 版本，再請主機商套安全更新。 ⭐ 文章深度讀：WordPress 站長要更新的是 PHP！十幾年老漏洞被 AI 找到 → https://heymaibao.com/wordpress-sites-need-php-update-4f330c/ ⚡ 章節重點 站長該升級的那一層 00:00 AI 壓低的找洞門檻 00:39 記憶體殘局的漏洞 01:18 當年擱下的修補難題 02:09 站長的檢查步驟 03:58 被提前打破的保密期 04:40 攻與修之間的時差 05:56 📝 懶人包 ∙ WordPress 官方說這次不出 WordPress 更新。 ∙ PHP 記憶體用完時沒收乾淨，殘局會被下一個請求接著用。 ∙ PHP 基金會說選修法、權衡相容、審修補，工具做不到。 ∙ 我的觀點：老漏洞不再因為太難打而安全，要確認主機商有更新。 📚 參考資料 PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet → https://www.wiz.io/blog/php2shell-php-rce Today's PHP Security Release, and How We're Strengthening PHP Security → https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ PHP Core Security Audit Results → https://thephp.foundation/blog/2025/04/10/php-core-security-audit-results/ Critical PHP Security Release → https://wordpress.org/news/2026/10/critical-php-security-release/ Get a faster, more secure website: update PHP today → https://wordpress.org/support/update-php/ Cloudflare deploys protections against php2shell vulnerability → https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ BOD 26-04: Prioritizing Security Updates Based on Risk | CISA → https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk Patch the Planet: global response coordination as agents uncover critical vulnerabilities → https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ Towards securing the internet → https://x.com/gdb/status/2112921529650688312 PHP: internals:extensions → https://wiki.php.net/internals/extensions Embargo Principles - Vultron CVD Protocol → https://certcc.github.io/Vultron/topics/process_models/em/principles/ Maintaining Pre-Disclosure Confidentiality - CERT® Guide to Coordinated Vulnerability Disclosure → https://certcc.github.io/CERT-Guide-to-CVD/howto/coordination/maintaining_secrecy/ PHP: News Archive - 2026 → https://www.php.net/archive/2026.php The PHP security team is giving advance notice: Upcoming security release Wed, O → https://x.com/thephpf/status/2112633155631108544