Special | A Patch It Properly Week

0:00 Hello everyone, welcome to Cyber Leaders. I'm James Lyne. And I'm Kieran Martin, and it's another special episode, James. This one, it's in commemoration of we've suddenly noticed it's Cybersecurity Awareness Month. How's that going for you this year, James?

0:16 I am feeling much more aware of Cyber than I think I ever have felt, Kieran, actually.

0:22 I mean, it's been a roaring success, Cybersecurity Awareness Month this year, certainly for me. It's been much better than Sober October, that's for sure. Now look, um uh joking aside, or joking paused, more accurately, um, there's quite a lot going on. And uh cybersecurity is leading the global news.

0:41 There's this PHP vulnerability, but there's lots of other things too. Why don't you set out for us just the full panopoly of what's going on? And then we'll look at PHP and maybe one other aspect of what's going on and try and give real, usable lessons for the cyber leadership community. So over to you.

1:00 What's going on, James?

1:01 What's the saying, Kieran? Um, nothing then uh nothing then all at once does seem to somewhat uh apply to this week. Yeah, look, I mean, the headlines are on fire in particular with these PHP flaws, two two very nasty remote code execution bugs that I know we'll dive into more. Yeah but what I think is particularly interesting as you've noticed, there's also flaws in bind that you know runs the infrastructure more broadly, DNS.

1:29 There's flaws in Python, in Node.js, um, some fascinating issues going on in the global kind of certification and crypto infrastructure, particularly in India. So it it just it just seems like simultaneously, all at once, everywhere across the globe decided to have some form of serious flaw.

1:49 So let me push you on this in terms of its consequences and also what it means strategically, because you know, like a lot of people, I'm waking up. I'm probably doing that stupid thing when you first wake up. I'm looking at social media. Very dangerous. Some people are sane, but I'm not. So we we look at social media and we look at the cyber subsection of social media.

2:09 And right now, there's a lot of people, particularly in the United States, but not confined to the US, who are saying, this is it. So insert the prefix, whether it's breach, vuln, cyber, whatever, but then use the suffix is pocalypse and it's beginning. This is the moment. We've been warning about it for ages.

2:26 But look, and they and they do your list. They do PHP, they do the India crypto thing that will come through, they do all sorts of other things, buying that you mentioned, and they say right. And some of them, and I've seen at least two viral essays on on this, are literally saying it's time to switch everything off and head for the hills.

2:42 It's time to stockpile cash, it's time to stockpile water. Even our own government here in the UK, although it's not specifically about cyber, it's a sort of unhappy coincidence that they're talking about wider things. But there people are getting serious advice that the digital age is now fraught with immediate life-threatening peril.

2:59 Um, you have a long perspective and a deep technical understanding of this. Is it just a set of unhappy coincidences in the same week? Is it a huge structural shift for the worst that's going to speed up and we're going to have every week like this in 2027? Or is it somewhere in between? What's going on strategically, James?

3:21 Yeah, good question. Look, I I um I do not love this fear-mongering that one must accumulate cans of spam in response to the impending Volume apocalypse. It's spam, but not as we know it in cybersecurity. It's an unfortunate food choice on my part there. Yeah, look, I I do think that um, you know, it is wrong to sit at either extreme on this.

3:47 To say that the likes of AI is having no impact on the work in cybersecurity, the opportunity for attackers, the pace, I think is wrong. To flip to this other extreme that every week will now be like this and that technology can no longer be trusted, I think is entirely disproportionate. Um, and perhaps, Kieran, in support of that, before we get into these kind of AI-assisted flaws that have been found in PHP, let's actually pick another example that's really serious, precisely because it has basically nothing to do with AI and these claims.

4:23 Okay. I think you're going to India, aren't you, James? I am. Yeah, look, amid all this sophistication comes a reminder that sometimes the problems are rather simpler. So for those of you that you know haven't read up on this one for all the other great distractions this week, e-Mudra, they're an Indian certificate authority.

4:43 Um, and in fact, the only Indian route certificate authority trusted globally. And these guys issued it kind of eight intermediate certificates whose private keys were so small you could guess them. And you might be thinking, oh, okay, you could guess them with you know mass computational power. And uh no, one of the numbers was four.

5:10 Not four bits, mind you, actually four.

5:14 Um I think you refer to EMUDR as India's formerly only trusted certificate authority. And what I do love about this is we're long used to, particularly in this part of the world, to Douglas Adams telling us that you know the key to the secrets of Earth and the secrets of human life is 42. Turns out the key to the secrets of India, the most populous country in the world.

5:33 The key to the secrets is four. It's even easier.

5:36 Okay. Along along with 66, 155, and 237. Well, that's a bit more complicated, James.

5:42 I mean, you you might need an LLM for that. Or perhaps. Oh, maybe, Karen.

5:48 We'll come to that because it's amazing. Oh, it's it's stunning, right? So, I mean, uh for for those who are less au fay with you know the the kind of technical specifics of how this ought to work, a proper key of this sort should be a random number that is hundreds of digits long. Right. Um, you know, and these examples we're talking about for 42, you know, they offer a few hundred possibilities at most.

6:17 Um, the infamous Scott Helm, fantastic security researcher, um, he recovered all eight from these uh public certificates in under a second. Um I dare say that you know, a toddler with a calculator was probably in with a sporting chance on this one. Excellent. Now, why this matters a little bit, and then let's come back to that AI point.

6:41 Um, look, we we have a technical set of listers here, so I won't overdo this, but certificate authorities are how your browser knows that your bank's website's really your bank. Yeah. Um, and of course, you know, if you've got one of these keys, you can mint a certificate for any site that you wanted.

7:00 Yeah. Um, so you could pretend to be a bank, you could launch all kinds of nasty phishing campaigns, you know, you name it. What bothers me here, Kieran, I think is pertinent to our discussion, is the visibility. Yeah, yeah. These keys sat in public certificates for over a year, there for anyone who wanted to look.

7:21 I mean, there was even a warning in May 2025 when the revocation lists failed their signature checks, which is you know, about as clear a red flashing light as you can get from this type of infrastructure. But it was patched over and filed as a process error. Wow. Um, you know, and and therefore, because of that, you know, independent auditors now are none the wiser on how much of this has happened.

7:47 We don't know how much it's been abused. Right. Um so you know, when someone says, you know, was anyone attacked? We don't know. It's kind of a don't know, don't think so, can't prove it.

8:00 But just because we'll need to get on to PHP, just to try to summarize this, we don't know what harm there's been, but clearly most of us haven't observed any that would affect us, say, outside India. So there is probably a difference in risk, isn't there, between what the risk is within India and what the risk is out with it.

8:19 So that's the first question I'd like you to deal with. And then, of course, the second one is this is on a big list of the AI apocalypse. Could you describe the AI dimension to this operation? Hint, it won't take very long. Yes, yes.

8:32 Uh look, I I think if you're looking at this flaw, um, the lesson stands that the mathematics are sound, right? This isn't some hyper impressive technical flaw in the crypto. It's what is so often the case in cybersecurity. The process around it failed. And as you've highlighted, Kieran, for those fretting that every great flaw now henceforth will be some AI-wrought super exploit, this one was very serious, very dumb, and entirely human.

9:05 I mean, e-mudge's statement did suggest the keys could have been cracked with an AI-assisted technique. I would gently observe that the technique in question was counting to 237, and that I might be able to accomplish that without supercharged AI LLM models.

9:24 Yeah. So the lesson being that you're supposed to have 237 digits in the key. It shouldn't be 237. That's the key mistake. Uh that's the critical uh mistake. And again, just for reassurance, there's clearly lots of mitigations and management to be done within the Indian, particularly the e-government system, for reasons that we won't go into.

9:45 But for the rest of us, this is not something that we have to go and fix and so forth. It's just an alarming reminder of some of the critical um weaknesses in human practice.

9:57 And Kieran, if I if I may, a reminder for all of us, amidst all these headlines um where there's a predisposition to look for the sophisticated and sexy with AI, sometimes it's just process screw-ups and nastiness and cruft. And a lot of the attacks around the world still come down to those hygiene configuration and process issues, even on the scale of global trust infrastructure.

10:22 Absolutely.

10:23 And onto hygiene, but onto something that people do have to fix or at least should fix. Let's talk a little bit about PHCP now. We don't want to go in because of to all of the details. As you say, it's a largely technical audience and Cybersecurity Awareness Month joking aside. Everyone will be aware of this.

10:40 Uh it is Walton.

10:41 And it's a great webcast if you want the technical details from Moses, Frost, and Rich Green. Where they go through the demo and explain it. So we won't do that today, as you say, Kieran.

10:50 And again, there's an AI, um, there is an AI dimension to this, and we can come in, we can come onto that in a little bit. But also there are words around being used like unprecedented. And whilst there aren't many precedents for this, there are some. Uh for those who've been around for a while, we've talked about log4j, log4 shell, and you know, for some of us this feels like log4j, but the media are reporting it, or you know, it's log4j again with wall-to-wall media coverage.

11:14 How does it look to you two, three days on, depending on when you start this? Because of course it was the leak of the pre-agreed vulnerability process rather disgracefully. Where are we now? Painful.

11:24 Yeah.

11:24 Where are we now?

11:26 Yeah, look, I mean, there's no doubt it's serious, Kira. And I don't think you and I would want to walk out of this podcast with folks rolling their eyes and saying, I'm not going to bother patching. Absolutely. Is unauthenticated remote code execution in software that's running in some bank of the web.

11:42 It's bad. People should be alarmed. There's something alarmed about it. That's right. You you must take action. And in the end, Kieran, we must press ourselves to give folks two or three things they they really need to pay attention to. But um, but it is a little bit more nuanced than the headlines and kind of black October and the end of the internet.

12:01 I mean, for one, Kieran, there's this line of millions of attacks. Lovely figure. But, you know, a honeypot getting hammered or attackers attempting isn't the same as winning. And it turns out that the public exploits of this are fussy, right? There's a lot of works on my machine versus someone else's.

12:26 And I I loved your comparison to log for shell because that was one line of text in a username field that kicked the door open reliably. This, at least yet, you know, is a serious flaw, but it's not kicking doors down the same way. The burglars are finding a lot of stiff handles. Oh, that was a good analogy.

12:48 I'm going to keep that one for the future. That is excellent. But let's dig into this a little bit. Because let's face it, James, you know, you are, at least for the most part, you're a goody, right? You try and do good, you try and build communities and so forth. But let's say, for example, I was able to harness the evil spirit of Claude that we've all been reading about, and I would be able to cast a spell on you and turn you and turn you bad, because you're a very, very capable hacker.

13:09 Um, and but also, I mean, you're running a huge global cybersecurity training company, but you know, in your spare time, uh, you still have time to keep yourself technically relevant. One has fun. I know you spent quite a lot of the last couple of days, ethically, of course, because we haven't cast the evil Claude spell on you, ethically trying to see if badness worked on this, because if you went to the dark side, you could cause an awful lot of trouble.

13:34 So I think it would be really interesting for our technical leadership, just to give us a sense, not so much of the details, but of your experience as a proper hacker, somebody who knows what to do with this stuff. How did you find trying to exploit safely and ethically? PHP to Shell.

13:50 Yeah, it it was a really interesting experience, Kieran, because I expected with the, you know, the published details, the availability of AI, and a lot of the noise around that one might feed it into AI and ask for a nice exploit, and the work would be done. And it would lead to this kind of bloodbath scenario that you know you you might read about in the news where you get, you know, pop pop and shell on PHP.

14:18 You just you press a button and it and it works. Um not so. And and interestingly, you of course, there are folks who are much more talented exploit developers again than me in the community I've been talking to, also. Um, our experience is you still need a lot of expertise in combination with AI and knowledge of the details to produce something useful.

14:41 Yeah. Like there wasn't this just kind of AI automated generated hack that came out of it. It took me a few hours to get to something useful on my machine, but that doesn't immediately mean that I can go and trounce around the internet and hit other people's systems. Um, so it is it's fussy and fiddly.

15:02 And I suspect in time, you know, more universal exploit versions will appear. But in this interim period, it is giving us some time to patch and it doesn't have the reliability of some of those prior exploits. This was fiddly, Kieran.

15:18 So let's try and bring this together for cyberleaders, because that's a really important and for now reassuring point, but I say for now, because we do do detail, we do do nuance, we do do subtlety on this podcast. That's the whole point of the damn thing, uh, rather than just, you know, hysterics. So as I read it from the much less technical background, so somebody like you, you know, super technical, very, very expert.

15:41 There are others that we've we've talked to and you've talked to, and they're all trying to see if this works. And that's the good side of things. On the bad side of things, we know, I mean, there is, and this is where AI comes in, there is an unprecedented volume of attack, of attempted attacks. And they will range from people, as one of my friends joked to me, people typing into an LLM, you know, hack PHP, make no mistakes, and seeing how they get on, which isn't gonna work.

16:06 I think you've established that beyond any doubt. Yep. No, no, no. But all the way, all the way through, and I'm serious about this, all the way through to teams of evil people, like evil versions of you, um, who are really, really good at this. And they're gonna spend all weekend trying to engineer this, trying to make it work, and they might succeed.

16:23 So again, this isn't just just being reassuring. There's a big risk out there. We've had a break. We've had a lucky break in that it's not log for it's not as easily exploitable as log4 shell. So if it takes them all weekend, well, then more and more people should patch between now and the other side of the weekend, et cetera, et cetera.

16:38 Is that a fair sort of summary of where we are?

16:41 Yeah, I I I love that, Kieran. And I and I and I think this you you kind of you highlighted our position of nuance, right? If anyone walks out of this going, oh, okay, not that bad. Never mind, I'm not gonna do anything. We failed. Yeah, absolutely. We also don't want folks running around with their hair on fire saying AI is successfully going to break every piece of software.

17:01 Oh my god, it's breaking the thing that powers the whole internet. That's gonna happen next week and the week after. This is still the domain of skilled security researchers in combination with AI being augmented, not this kind of one-button exploit. But but Kira, should should we, I guess we should try and pick three or four things um for security leaders to do right away.

17:26 I've got a couple in mind, unless you want to go first.

17:28 No, I mean, just a reflection more. I think, you know, AI, let's set aside the apocalypse and pea doom argument and all that nonsense. I mean, it's a tool. And uh it's it's been a complicated tool for both good and bad. It's been both hero and villain of this piece. You know, AI has part funded and assisted the research that got us to identify this 14-year-old vulnerability that was going to be found at some point.

17:48 And so I think it shows us that the way AI impacts on cyber is going to be complicated. It's gonna be a mixture of good and bad. And actually, you know, to try to introduce to try to um hand over on a point of I think reasoned but cautious optimism, if we do the right thing, AI will be a net benefit in this particular case.

18:07 There'll be other cases where it's a net problem, but and we're gonna be here for ages. So I just wanted to make that observation in terms of the CAM. And then I think definitely, you know, I'll just do the I'll just do the clever analytical observation. Can you do the actually useful practical advice, please?

18:24 You got it. You got it. We're a wonderful team, Kieran. Um, like uh like an evil Claude, might one might say. Um yeah, look, for for the for security leaders out there, I'm sure that you and your teams are already on to, you know, the harsh realities versus the headlines, but let's just make it clear.

18:41 Patch the engine, not the paintwork, right? It's not about updating WordPress. You've got to get the PHP runtime upgraded. Um, number two, you're probably getting more risk from the stuff no one owns. You probably are thinking about your website. What about all the other services? The partner portal off to a side, the thing running under someone's desk.

19:04 Remember that these patches don't go all the way back through the entire history of PHP. So a PHP 7 server under someone's desk or a vendor appliance that hasn't been updated, those are the things to isolate and chase down. Um and you know, lastly, if I may, count patched hosts, not blocked attacks. Right?

19:30 There's this narrative forming around a million blocked requests, look at what our WAF is doing. When you really come down to it, this is a project of hygiene where you're attempting to deploy good coverage to reduce the possibility of this exploit in the future. Don't get too hung up on the controls in front of it or the volume story.

19:52 Um, so Kieran, I mean, if you'll allow me a a little a little technical reflection like yours, but for me, this is a patch it properly week. Yeah. It it might seem like a fire alarm week, but use this window while the exploits are clunky, because they often don't stay that way, um, and get the patching done.

20:13 And for the cybersecurity community, remember if we cry log for shell every time, if we do this week after week, and because it's sexy and it's got AI assistance in it, no one's gonna listen when the real ones turn up. You know, these flaws have been sat in PHP for years. AI helped find them, helped build exploits.

20:37 I think, Kieran, as you said, a lot more of that is going to happen. But for us as security leaders, I've said it before and I'm gonna say it again clearly here AI is gonna change the game. It's gonna change some of the players, some of the rules. It doesn't change what winning looks like. Attackers still want your data, your money, your access.

20:56 So know what matters in your organization, know what someone's gonna come for, and make sure the controls and the people guarding it are up to the job. You do that, and the next round of worst bug ever is a busy week rather than a bad one.

21:12 And that's where we want to get to. So thank you for that brilliant mix of specific technical advice all the way through into how to handle the people that you need support from in your organization to go and fix this, how to pitch it properly, because this isn't the last time we're going to be here, but we can't be here every day.

21:29 And we're not going to be here every day. So it's important to help work out what matters. So that brings us to the end of this special episode of the Sans Cyber Leaders podcast. We'll have a regular season back pretty shortly. We may have another special episode or two. Who knows? It kind of depends what happens.

21:48 Hopefully, we're not back next week with another week like this. Probably when someone picks a private key of 42 after you suggested it, Kieran. Well, exactly. But I will make no predictions other than, as they've long said in this country, we'll meet again. Don't know where, don't know when, but I know we'll meet again some cyber day.

22:06 You can leave us feedback at Sans Cyberleaders the website. You can email us at cyberleaderspodcast at sans.org. There are multiple ways, but please do give us ratings and so forth. It really helps. But for now, from me, Kieran Martin. And for me, James Lyme, it's keep cybering and goodbye. And good luck patching all the things.