2026年10月23日 (五) 02:38 云云

2026-10-23T02:38:44Z

←上一版本		2026年10月23日 (五) 02:38的版本
第7行：		第7行：
	\| CVE = {{CVE\|2026-109618}} <br> {{CVE\|2026-109619}}		\| CVE = {{CVE\|2026-109618}} <br> {{CVE\|2026-109619}}
	\| image = CaelLab Phabricator PHP2Shell.png		\| image = CaelLab Phabricator PHP2Shell.png
	\| caption = [[CaelLab]]'s ~~[[Phabricator]]~~ instance as seen hours before the patch, having been disabled as a precaution		\| caption = [[CaelLab]]'s instance as seen hours before the patch, having been disabled as a precaution
	\| discovered = {{Start date and age\|df=yes\|2026\|8\|1}}		\| discovered = {{Start date and age\|df=yes\|2026\|8\|1}}
	\| patched = {{Start date and age\|df=yes\|2026\|10\|21}}		\| patched = {{Start date and age\|df=yes\|2026\|10\|21}}

2026年10月23日 (五) 02:35 云云

2026-10-23T02:35:42Z

←上一版本		2026年10月23日 (五) 02:35的版本
第6行：		第6行：
	\| name = PHP2Shell		\| name = PHP2Shell
	\| CVE = {{CVE\|2026-109618}} <br> {{CVE\|2026-109619}}		\| CVE = {{CVE\|2026-109618}} <br> {{CVE\|2026-109619}}
	\| image = ~~Wikimedia~~ Phabricator PHP2Shell.png		\| image = CaelLab Phabricator PHP2Shell.png
	\| caption = [[~~Wikimedia~~]]'s [[Phabricator]] instance as seen hours before the patch, having been disabled as a precaution		\| caption = [[CaelLab]]'s [[Phabricator]] instance as seen hours before the patch, having been disabled as a precaution
	\| discovered = {{Start date and age\|df=yes\|2026\|8\|1}}		\| discovered = {{Start date and age\|df=yes\|2026\|8\|1}}
	\| patched = {{Start date and age\|df=yes\|2026\|10\|21}}		\| patched = {{Start date and age\|df=yes\|2026\|10\|21}}

云云：创建页面，内容为“{{Short description|2026 software security vulnerability}} {{Current|2=current cybersecurity incident|date=October 2026}} {{Use Canadian English|date=October 2026}} {{Use dmy dates|date=October 2026}} {{Infobox bug | name = PHP2Shell | CVE = {{CVE|2026-109618}}
{{CVE|2026-109619}} | image = Wikimedia Phabricator PHP2Shell.png | caption = Wikimedia's Phabricator instance as seen hours before the patch, having been disabled as a precaution | discove…”

2026-10-23T02:31:41Z

创建页面，内容为“{{Short description|2026 software security vulnerability}} {{Current|2=current cybersecurity incident|date=October 2026}} {{Use Canadian English|date=October 2026}} {{Use dmy dates|date=October 2026}} {{Infobox bug | name = PHP2Shell | CVE = {{CVE|2026-109618}} <br> {{CVE|2026-109619}} | image = Wikimedia Phabricator PHP2Shell.png | caption = Wikimedia's Phabricator instance as seen hours before the patch, having been disabled as a precaution | discove…”

新页面

{{Short description|2026 software security vulnerability}}
{{Current|2=current cybersecurity incident|date=October 2026}}
{{Use Canadian English|date=October 2026}}
{{Use dmy dates|date=October 2026}}
{{Infobox bug
| name = PHP2Shell
| CVE = {{CVE|2026-109618}} <br> {{CVE|2026-109619}}
| image = Wikimedia Phabricator PHP2Shell.png
| caption = [[Wikimedia]]'s [[Phabricator]] instance as seen hours before the patch, having been disabled as a precaution
| discovered = {{Start date and age|df=yes|2026|8|1}}
| patched = {{Start date and age|df=yes|2026|10|21}}
| discoverer = Calif, [[OpenAI]], [[Wiz, Inc.|Wiz]]
| website =
| affected software = [[PHP]] versions 5.4–8.5<ref>{{cite web |title=PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet {{!}} Wiz Blog |url=https://www.wiz.io/blog/php2shell-php-rce |website=wiz.io |ref=Wiz |language=en-us |date=21 October 2026}}</ref>
}}

'''PHP2Shell''' is a pair of high-impact [[Vulnerability (computer security)|vulnerabilities]] ('''CVE-2026-109618'''<ref>{{cite web|url=https://www.cve.org/CVERecord?id=CVE-2026-109618|title=CVE-2026-109618|publisher=Mitre}}</ref> and '''CVE-2026-109619'''<ref>{{cite web|url=https://www.cve.org/CVERecord?id=CVE-2026-109619|title=CVE-2026-109619|publisher=Mitre}}</ref>) in [[PHP]] versions 5.4{{endash}}8.5 that allow [[Arbitrary code execution|remote code execution]] (RCE). Their existence was publicly announced on 20 October 2026.<ref name="oct20">{{Cite web |date=20 October 2026 |title=PHP: News Archive - 20 Oct 2026 |url=https://www.php.net/archive/2026.php#2026-10-20-1 |access-date=21 October 2026 |website=www.php.net |language=en}}</ref> An emergency [[Patch (computing)|patch]] for versions 8.2, 8.3, 8.4 and 8.5 and details about the vulnerabilities were released the following day.<ref name="oct21">{{Cite web |date=21 October 2026 |title=PHP: News Archive - 21 Oct 2026 |url=https://www.php.net/archive/2026.php#2026-10-21-5|access-date=21 October 2026 |website=www.php.net |language=en}}</ref>

==Discovery==
PHP versions as early as 5.4 (released in 2012)<ref>{{Cite web |title=PHP: Releases |url=https://www.php.net/releases/index.php |access-date=22 October 2026 |website=www.php.net |language=en}}</ref> are affected by these vulnerabilities, and while concerns around [[memory safety]] bugs had been raised decades before, no action was taken at the time because it was not thought that developing a working [[Exploit (computer security)|exploit]] could be feasible.<ref name="Kan2026" /><ref name="McMillan2026" details="{{subref|q=The class of bugs had been hiding in PHP's source code for years. A security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten, Duong said.}}">{{cite news |last1=McMillan |first1=Robert |title=Exclusive {{!}} AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk |url=https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea |url-access=subscription |access-date=21 October 2026 |work=Wall Street Journal |date=21 October 2026}}</ref> A PHP core developer discovered the [[Out of memory|out-of-memory]] error behind one of the vulnerabilities during an audit in 2024, but the [[Software bug|bug]] was never fixed; the development team could not reach consensus on how to do so and a specific exploit had not yet been discovered, so the issue was not prioritized.<ref name="Constantin2026">{{cite news |last1=Constantin |first1=Ana Maria |title=PHP knew about one of the flaws in 2024 but could not agree a fix |url=https://thenextweb.com/news/php-foundation-structural-failure-2024-flaw-leak |access-date=21 October 2026 |work=The Next Web |date=21 October 2026}}</ref><ref>{{Cite web |title=Today's PHP Security Release, and How We're Strengthening PHP Security |url=https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ |access-date=21 October 2026 |website=thephp.foundation |language=en}}</ref>

The vulnerabilities were independently discovered by two parties: Ryan Austin, a researcher at the [[California]]-based<ref>{{cite news |last1=Volz |first1=Dustin |title=A Hacking Tool Built With A.I. Can Breach Phones Without a Click |url=https://www.nytimes.com/2026/09/08/us/politics/calif-ai-worm-wechat-hack.html |access-date=21 October 2026 |work=The New York Times |date=8 September 2026}}</ref> security firm Calif, as part of the [[OpenAI]] "Patch the Planet" project in August 2026, and the Israeli–American cloud security company [[Wiz, Inc.|Wiz]], a subsidiary of [[Alphabet Inc.]] and a part of [[Google Cloud]].<ref name="McMillan2026" details="{{subref|q=Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI's most advanced models, during an audit of PHP's source code in August. ... Researchers from Google's Wiz cybersecurity team soon reached out with new exploits, which they had discovered independent of Calif. }}" /> Austin used OpenAI's [[GPT-5.6 Sol]] model to assist with finding the vulnerability.<ref name="McMillan2026" details="{{subref|q=Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI's most advanced models, during an audit of PHP's source code in August. ... Researchers from Google's Wiz cybersecurity team soon reached out with new exploits, which they had discovered independent of Calif. }}" /> Wiz researchers used the large language models [[Gemini (language model)|Gemini 4 Argon]] and GPT-5.6 Sol, as well as their own tool, Wiz Atlas, to help with their research.<ref name="Satter2026" />

The vulnerability was rated 9.2 (critical) out of 10 under [[Common Vulnerability Scoring System|CVSS]] v4.0 by PHP developers,<ref>{{Cite web |title=php.announce: [ANNOUNCE] Upcoming Critical PHP Security Release |url=https://news-web.php.net/php.announce/509 |access-date=21 October 2026 |website=news-web.php.net}}</ref> while security firm watchTowr rated it a full 10.0.<ref name="Abrams">{{Cite web |last=Abrams |first=Lawrence |title=PHP warns admins of two critical flaws, emergency patches coming tomorrow |url=https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/ |access-date=21 October 2026 |website=BleepingComputer |language=en-us}}</ref>

==Patches==
The maintainers of PHP released patched versions of PHP 8.2, 8.3, 8.4, and 8.5 (8.2.35, 8.3.36, 8.4.27, and 8.5.12).<ref name="oct21" /> Source code patches were released for version 7.4, 8.0, and 8.1, but no official updated binaries for those versions were released as they are considered [[Software release life cycle#End-of-life|end of life]].<ref name="oct21" /> Temporary mitigations were also published, but the maintainers said there were no complete mitigations and that updating was the only safe choice.<ref name="oct21" /> Both vulnerabilities were published through [[GitHub]] security advisories on 21 October 2026 at 13:34 UTC,<ref>{{cite web|url=https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w|title=RCE via OOM corruption|date=21 October 2026|access-date=21 October 2026}}</ref><ref>{{cite web|url=https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp|title=RCE via stale global state|date=21 October 2026|access-date=21 October 2026}}</ref> 26 minutes before the announced release time, with the PHP website updated shortly thereafter.<ref>{{Cite web |last=Scherzer |first=Daniel |date=22 October 2026 |title=Blog: PHP2Shell: a Timeline |url=https://scherzer.dev/Blog/20261022-php2shell-timeline |access-date=22 October 2026 |website=scherzer.dev |language=en}}</ref>

The PHP maintainers announced the update early and before release, after news of the vulnerabilities leaked on 20 October on the [[Hacker News]] forums,<ref>{{Cite web |title=Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming |url=https://news.ycombinator.com/item?id=50167754 |archive-url=https://web.archive.org/web/20261021192245/https://news.ycombinator.com/item?id=50167754 |archive-date=21 October 2026 |access-date=22 October 2026 |website=news.ycombinator.com |language=en}}</ref> in a post on [[X (social network)|X]] by cybersecurity company watchTowr labs, and in a [[proof-of-concept]] exploit video mistakenly released by Calif.<ref name="Khandelwal2026-1">{{cite news |last1=Khandelwal |first1=Swati |title=PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert |url=https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html |access-date=21 October 2026 |work=The Hacker News |date=21 October 2026 |language=en}}</ref>{{Unreliable source? |reason="The Hacker News" uses AI for article images, so it likely also uses AI for article text. |date=October 2026}}<ref name="McMillan2026" details="{{subref|q=News of the patch leaked out Tuesday, in a post to Hacker News, just under two days before the patch release.}}" /><ref name="Constantin2026" /> The early notice on PHP.net encouraged users to prepare and update as soon as the patch was released.<ref name="oct21" /> One security firm, Sansec, expected "mass attacks to start within 15 minutes of the release".<ref>{{Cite web |last=Goodin |first=Dan |date=20 October 2026 |title=PHP warns it plans to release 2 emergency patches imminently |url=https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/ |access-date=21 October 2026 |website=Ars Technica |language=en|archive-url=https://web.archive.org/web/20261021121524/https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/|archive-date=21 October 2026|url-status=live}}</ref> Proof-of-concept exploits, write-ups, and partial mitigations started circulating on the [[Internet]] before the end of the embargo, after development platform Chainguard released patched versions of the software early; this allowed attackers to determine what code had been changed.<ref name="Abrams" /><ref>{{Cite web |title=Only for the curious... |url=https://jackalsyn.com/posts/php-up-2026.html |access-date=21 October 2026 |website=jackalsyn.com}}</ref><ref name="Constantin2026" />

[[Amazon Web Services|Amazon]] Threat Intelligence identified a PHP2Shell exploitation attempt dating back to 17 October 2026, in MadPot telemetry, four days before public disclosure.<ref>{{Cite web |date=21 October 2026 |title=Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot {{!}} AWS Security Blog |url=https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ |access-date=22 October 2026 |website=aws.amazon.com}}</ref> [[Cloudflare]] reported signs of early exploitation prior to public [[Patch (computing)|patch]] release, and deployed temporary [[web application firewall]] (WAF) rules as an attempted stopgap mitigation against the [[Vulnerability (computer security)|vulnerability]].<ref name="Gatlan2026">{{Cite web |last=Gatlan |first=Sergiu |date=21 October 2026 |title=PHP ships emergency patches for critical PHP2Shell flaws |url=https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/ |access-date=21 October 2026 |website=BleepingComputer |language=en-us}}</ref><ref>{{Cite news |date=21 October 2026 |title=Hold on to your butts: Web admins braced for emergency PHP updates to plug leaked exploits |url=https://www.pcgamer.com/software/security/we-expect-mass-attacks-to-start-within-15-minutes-of-the-release-web-admins-braced-for-emergency-php-updates-to-plug-leaked-high-severity-holes/ |access-date=21 October 2026 |work=PC Gamer |language=en}}</ref><ref>{{cite web |last1=Knecht |first1=Dane |title=Dane Knecht 🦭 (@dok2001) on X |url=https://x.com/dok2001/status/2112811965735202970 |website=X (formerly Twitter) |date=21 October 2026}}</ref> Security firm watchTowr said it had observed exploitation in the wild by 21 October through its [[Honeypot (computing)|honeypot]] network,<ref>{{Cite web |date=20 October 2026 |title=PHP RCE FAQ: PHP2Shell CVE-2026-109618 & CVE-2026-109619 |url=https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ |access-date=21 October 2026 |website=watchTowr |language=en}}</ref> while the [[United States|US]] [[Cybersecurity and Infrastructure Security Agency]] (CISA) said it had not observed exploitation as of the same day.<ref name="Collier2026" />

== Impact ==
[[File:Php2shell wiki.png|thumb|Warning posted on the [[English Wikipedia]] about community-owned tools being offline due to the PHP2Shell incident.]]
Approximately 69% of websites use PHP, including those that use [[content management system]]s such as [[Drupal]], [[Joomla]], and [[WordPress]], so the potential impacts were widespread.<ref name="Collier2026">{{cite news |last1=Collier |first1=Kevin |title=Critical vulnerabilities in commonly used web code spark rush to update systems |url=https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751 |access-date=21 October 2026 |work=NBC News |date=21 October 2026 |language=en}}</ref><ref name="bbc">{{cite news |last1=Gerkin |first1=Tom |title=Websites taken down worldwide as critical PHP cyber-security update issued |url=https://www.bbc.com/news/articles/cmly0lg3w5x2o |access-date=21 October 2026 |work=BBC News |date=21 October 2026}}</ref> PHP is also bundled with vendor appliances, [[web hosting service|web host]] control panels such as [[cPanel]] and [[Plesk]], and some [[Windows]] applications.<ref>{{Cite web |last=Hammond |first=John |date=21 October 2026 |title=Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) |url=https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities |access-date=21 October 2026 |website=Huntress |language=en}}</ref>

Following advice from [[Computer emergency response team|CERT]]-EU and the British [[National Cyber Security Centre (United Kingdom)|National Cyber Security Centre]], many organizations across Europe took their websites offline as a precaution while the patches were pending, including the [[Netherlands|Dutch]] government portal Overheid.nl, the [[Denmark|Danish]] national school communication platform, all [[Finland|Finnish]] government public-facing web services, and all websites of the [[Ministry of the Interior (France)|French Interior Ministry]].<ref name="Satter2026">{{Cite news |last=Satter |first=Raphael |last2=Marchandon |first2=Leo |last3=Ghosh |first3=Kanjyik |last4=Pardesi |first4=Rajveer |date=21 October 2026 |title=Government websites go dark after AI-discovered flaw sparks security scramble |url=https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/ |access-date=21 October 2026 |work=Reuters |language=en}}</ref><ref name="bbc" /><ref>{{Cite web |last=Van Dessel |first=Josse |date=21 October 2026 |title=Major websites go offline as critical PHP vulnerability triggers security fears |url=https://www.brusselstimes.com/belgium/2371464/major-websites-go-offline-as-critical-php-vulnerability-triggers-security-fears |access-date=21 October 2026 |website=The Brussels Times |language=en}}</ref><ref>{{cite press release|url=https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php|publisher=National Cyber Security Centre|date=21 October 2026|title=Critical security issue affecting PHP}}</ref> The US [[National Security Agency]] recommended that websites go offline if unable to update immediately.<ref name="Kan2026">{{cite news |last1=Kan |first1=Michael |title=This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says |url=https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says |access-date=21 October 2026 |work=PCMAG |date=21 October 2026 |language=en}}</ref><ref name="NSA">{{cite web|url=https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-php-updates/ |title=NSA Advisory: PHP Updates |author= |publisher=[[National Security Agency|NSA]] Press Room |date=21 October 2026 |access-date=21 October 2026 |quote=Effective immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.}}</ref> The UK National Cyber Security Centre released a similar warning, urging organizations to be wary of [[backdoor (computing)|backdoors]].<ref>{{cite news |last1=Booth |first1=Robert |last2=Down |first2=Aisha |title=Flaw in PHP computer language leads to shutdown of websites around world |url=https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world |access-date=21 October 2026 |work=The Guardian |date=21 October 2026}}</ref> The Japanese National Cybersecurity Office advised PHP users to immediately update their systems.<ref name="ITmedia-21oct2026" />

The [[Wikimedia Foundation]] shut down many of their supporting services, and [[Internet forum|forum]] sites [[4chan]] and [[Something Awful]] went offline.<ref name="Collier2026" /><ref name="Tauber-2026">{{Cite web |last=Tauber |first=Olivia |date=21 October 2026 |title=PHP vulnerability: Which websites and services are affected? |url=https://mashable.com/tech/php-vulnerability-websites-offline-affected-services |access-date=21 October 2026 |website=Mashable |language=en}}</ref><ref name="Kan2026" /> Parts of the Japanese internet also went offline, including games such as ''[[Umamusume: Pretty Derby]]'', ''[[Granblue Fantasy]]'', ''[[Princess Connect! Re:Dive]]'', and numerous online commerce sites.<ref name="ITmedia-21oct2026">{{cite news|url=https://www.itmedia.co.jp/news/article/2610/21/2000002472/|date=21 October 2026|title=著名ITサービス相次いで緊急メンテへ　コドモン、シャドバ、BASE、さくらのレンタルサーバなど　「PHP」脆弱性に起因か|trans-title=Several prominent IT services—including Codmon, Shadowverse, BASE, and Sakura Rental Server—have initiated emergency maintenance, likely due to a vulnerability in PHP|publisher=ITmedia|access-date=21 October 2026 |language=ja}}</ref><ref name="Tauber-2026" /> The [[Internet Archive]] briefly shut down to fix the issue.<ref>{{Cite web |last=Smith |first=Paul |last2=Mizen |first2=Ronald |date=21 October 2026 |title=AI just discovered a bug putting 70pc of world's websites at risk |url=https://www.afr.com/world/north-america/websites-go-dark-as-ai-discovered-bug-sparks-global-security-scramble-20261022-p617nf |access-date=22 October 2026 |website=Australian Financial Review |language=en}}</ref>

== Analysis ==

Researchers at Wiz stated that the issue was on par with [[Heartbleed]], a 2014 vulnerability that affected an encryption library used by about two-thirds of the web at the time.<ref>{{cite news |last1=Eadicicco |first1=Lisa |title=Global websites shut down after AI found a critical flaw affecting 70% of the internet {{!}} CNN Business |url=https://edition.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai |access-date=22 October 2026 |work=CNN |date=21 October 2026 |language=en}}</ref> Commentary in ''[[The Guardian]]'' noted that [[the PHP Foundation]], which maintains the PHP language, only had 13 full- and part-time employees, and relied on financial contributions, whereas AI research, which was credited with helping discover the vulnerability, received "billions" in investment.<ref>{{cite news |last1=Taylor |first1=Josh |title=What is PHP, and how bad is the computer language flaw causing website shutdowns globally? |url=https://www.theguardian.com/technology/2026/oct/22/what-is-php-computer-language-flaw-causing-global-website-shutdowns |access-date=22 October 2026 |work=The Guardian |date=22 October 2026}}</ref> Coverage in ''[[The New York Times]]'' said that PHP was "pervasive" and speculated that "everyday users" could have their personal [[data]] put at risk.<ref>{{Cite news |last=Adam |first=Karla |last2=Volz |first2=Dustin |date=22 October 2026 |title=What Is PHP? Why Are Government and Business Websites Going Offline? |url=https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerability-risks.html |access-date=22 October 2026 |work=The New York Times |language=en-US |issn=0362-4331}}</ref>

== See also ==
* [[Log4Shell]], a similarly named vulnerability

== References ==
{{Reflist}}

== External links ==
*[https://www.php.net/archive/2026.php#2026-10-21-5 Announcement by the PHP Project]
*[https://calif.io/php2shell Calif explanation of the vulnerabilities]
*[https://www.wiz.io/blog/php2shell-php-rce Wiz explanation of the vulnerabilities]
{{Hacking in the 2020s}}

[[Category:2026 in computing]]
[[Category:Computer security exploits]]
[[Category:PHP]]

PHP2Shell - 版本历史

2026年10月23日 (五) 02:38 云云

2026年10月23日 (五) 02:35 云云