Is AI Breaking the Internet Faster Than We Can Patch It?

0:00 All right, guys, a massive amount of vulnerabilities have been discovered thanks to AI over the last week. And it seriously has been one after another. And it feels like the internet is about to collapse. Every foundation that we've relied on to make the internet work, websites work and applications and all that, there've been vulnerabilities in pretty much all of them. The first one that came out was the big PHP one, the programming language that powers so much of the internet, they say 70% plus of the internet runs on PHP. And I'm a part of that community.

0:38 And that community got a lot of grief when those vulnerabilities came out. But a few hours later, other communities such as Node, Ruby, and all these other top tier programming languages and pieces of software all had critical vulnerabilities released about them as well. And they had to all frantically go and patch them using AI tools too. So let me go through how bad this is and what kind of impact it has for the internet and us general users overall. Now, most of the internet is dubbing this Black October because of the massive amount of vulnerabilities that had been released. So if you have a look at this, we had PHP, Node, Ruby, Fortinet, Microsoft, even SSL certificates, authority being compromised and even AI tools. So

1:27 everything was compromised along the way. There was nothing that was left unscathed here. And the common thread is that AI finds the bugs and then people are using AI to either weaponize it or create the patches to fix things up. And there's a lot of conspiracies going on out there saying that because OpenAI and Anthropic are heading towards their IPOs really soon, they're creating all this drama and attention around the use of their AIs so that it gets more attention in their IPO sales. That's one of the conspiracy theories. I don't know what to think about that, but leave a comment down below and let me know what you guys think. But let's go through some of these vulnerabilities. First off was the PHP to

2:10 shell vulnerability. Now this one here, two floors, 9.2 out of 10, that's how severe it is. And this one allowed you to run code with no login on the server that you're attempting to hack. Now PHP, like I said, runs around 70% of the internet, all these websites out there, including WordPress. I am a WordPress developer, so this one hit home for me. WordPress powers over 40% of the internet.

2:36 And I also used to work in the Drupal and Joomla ecosystems too. And they power a lot of government websites. So hence, you may have heard or seen various governments, agencies around the world worrying about this. So what they did was they just shut down their websites. Instead of opening themselves up and leaving themselves compromised, they just went, we'll just turn it off. We'll cut all access to these servers until we can actually patch them and fix them and know that they're secure and then turn things on after that. So that was literally one of the plays, one of the strategies they had to do to actually secure themselves so that they knew that their environments weren't compromised.

3:18 Very drastic measures, but it's something they had to do. Now, a lot of crypto stores out there use PHP. There's a lot of payment plugins for WordPress that use PHP as well. So all of these avenues could be possible vectors of attack and could compromise your crypto assets. And me as a person that's building in the crypto space, that has me very worried as well. Now, it was reported that Amazon saw this attack four days earlier before it was all announced. And Cloudflare, who is a DNS layer, a domain name server layer that protects a lot of the internet, saw millions of these attempted attacks once the vulnerability was announced. So they had to float a lot of these vulnerabilities as they were happening. And thankfully they could,

4:07 because it protected millions of websites, including a lot of the ones that I helped manage as well. Now, this here is a official announcement from the NSA. They said, patch it or go offline. And like I said, a lot of websites around the world just decide to go offline. Now this next vulnerability here is Fortinet VPN. This VPN is used by so many companies around the world to allow people to work from home. If you log in with Fortinet VPN, it will allow you to have access to your work environment. So maybe an intranet or internal servers within a work environment. This piece of software had a flaw in it that allowed anyone to access those secure environments. That's huge. And there's been hackers that have

4:55 been taking advantage of this, stealing credentials and getting into all sorts of devices within these secure networks. So this one is a massive impact for a lot of companies that rely on this type of security to secure their internal infrastructure and internal networks. So we have no idea exactly how impactful this particular vulnerability has been. And I've got some comments here from the International Cyber Digest. They state here that the hacker, Kot, breached 924 more Fortinet firewalls than first known, Hudson Rock says. They hold 40,573 clear text secrets, including 1,576 Active Directory bind passwords. And here is another comment from the team as well. Attackers are exploiting the critical Fortinet 40SIM floor that lets them

5:48 run code without logging in. So Fortinet is telling customers to patch its firewalls now but won't say what the critical flaws are until November 10. So that's kind of a little bit concerning in itself because if you don't know what the flaw is, it makes it a lot harder to try and find what potential hackers were getting into and how they were getting in. If you kind of knew how they were getting in, it might have left fingerprints or some clues in regards to what might have been tampered with. But we don't know and we won't know until the 10th of November. Fingers crossed the damage on this one isn't too big. Now this next one here is Node.js and Node-to-Shell. And this one, again, very similar to PHP, allows you to run and execute

6:30 code through the Node environment. So Node runs a huge chunk of web apps and developer tools out there. I use it in pretty much every single website that I build because it runs all the build tools. It does all the optimization, the linting and everything else around it. So I rely on Node. So on the 21st of October, 10 fixes, four rated high. There was a big one here called the Brotli compression bug and it crafted data and possible code execution. And that was the big one there.

7:01 And Brotli is used everywhere, right? We use it in all of our sites to optimize various images and stuff to compress that, to make it as small as possible. And this one here was found by OpenAI's Codex security team. So this is OpenAI actively going out there trying to find the vulnerabilities. A lot of these vulnerabilities, I'm very surprised at the moment that they are being announced very quickly and there's no time for developers and people out there that use the tools to patch before the vulnerabilities are announced. That's the way it should happen. They release the patch, they make everyone update as quickly as possible, and then they release the details of that particular vulnerability

7:45 so that the hackers, the scammers, the people out there that are trying to take advantage of this don't have a head start. In this case, we're seeing so many of these vulnerabilities being announced before there are patches and the hackers getting a massive head start, especially with AI and impacting so many pieces of software out there. Now, this one here is kind of funny. I don't know if it's funny or not. This is Imadra and the number four. And I say the number four because that was literally the password for the SSL certificate. Not the password, but the key that was used for the certificate. Now, these certificates, they're supposed to have 100 plus digits and random numbers. And that makes it really hard to try

8:26 and guess what it is. It makes a brute force attack very costly and it could take a very long time. With quantum computers, of course, that's going to be faster. But that's another problem that we can come to in the future. But this problem here was that the certificate number was literally the number four. Now, in order to crack this, a researcher named Scott Helm cracked it on his laptop in under a second because it was the number four. Literally, his script was just going one, two, three, four.

8:56 I'm in. I'm in. And that was it. So it would have been extremely surprising. So this affected a certain set of certificates. I think it was about eight keys that had to be reissued globally. And there are still fixes that are being done out there. And if you have a macro operating system and may have these certificates stored locally on your computer and there are fixes for that.

9:19 So you may want to look up those fixes and fix it on your laptop just in case it's using those certs to verify that you're going to a particular website. So these SSL certificates that are supposed to protect your data between yourself and the website are very important. And for a long time, the internet wasn't very secure, but these certificates make it secure. So it's important to ensure that the certificate that you're using isn't hackable, like the number four, like this one here. Now, the impact from this one here, from what I've read, eHumandra is quitting the global SSL business. After that mistake, it probably absolutely ruined their reputation and no one would actually trust them to issue certificates ever again. So that is very impactful

10:04 in regards to some of these vulnerabilities that have been found. Now, this next one here is LiteLLM and the hunt for AI keys. And I thought this one was quite interesting because this is an AI gateway tool. It has about... 23 million downloads a week. So it's huge. It's very impactful. And essentially what the hackers were doing, they were looking for cloud keys, passwords, AI keys, and anything else that was in the system. And every time Python started, you could probably trigger all these keys and get access to them.

10:40 So other AI platforms that work in the middle between like OpenAI and Cloud Code, for example, And other platforms, intermediaries that work in between AI as an interface, such as Railway, will also breach the same week. And attackers were after those AI keys. Because once you have those AI keys, it's literally unlimited credits because you're using someone else's credits. So if you're looking at your AI usage and you went, well, I've used a lot of credits this week, what happened there? Your keys may have been compromised.

11:14 You may have accidentally put your keys online somewhere And as a result, it's been discovered in this particular breach and being used by hackers now to find other hacks, vulnerabilities and exploits out there or even take advantage of them. So it could be even worse. So is the internet ending? No, not quite. But the clock is a lot faster. Everything is happening at breakneck speed. The AI tools out there are finding these vulnerabilities and publishing them a lot faster.

11:43 They're finding ways to exploit them a lot faster. So these hackers can get in and compromise systems. This particular user here posted up a test to see if anyone could actually exploit the PHP vulnerability. From his point of view, it was quite hard to do. And in some cases, it was a little bit impossible. So he put up his Bitcoin here for anyone to hack. And then 19 hours later, someone stole it. So he made it possible to make that happen. But it's a little bit interesting.

12:14 He didn't have the PHP file on the server at first. So he had to put it on there. And as soon as it was on there, someone managed to hack it in 19 hours. So it may have been even shorter if those files were available. So that's how crazy things are. But on the good side, the defenders, the sysadmins that haven't slept all week, do have the tools and the ability to fix and defend against these vulnerabilities very quickly too. So for me, for example, I've been running scripts and AI agents to go through every last line of code, look for new announcements, independencies that have vulnerabilities, and patch things on a daily basis. So every morning I get a report, I can see exactly what's been patched overnight, and I can see where things are at

12:58 and make sure things are published and get the messaging out there that these plugins have been updated. Please go update them on your websites as soon as possible. So that's the pace of things now. at the moment. It is so much faster than before. So what can you do this week? I suggest turning on auto update for everything.

13:17 If you haven't turned on auto update for your windows operating system, for all your websites, whatever it is, make sure auto updates are on so you can get the latest patches as soon as they're released. Now, if you're using vulnerable authenticators like Microsoft authenticator, make sure you update that one as well. I didn't mention that one in the video, but it's something to be aware of too. Now, if you run a website, if you have a small business that is working on WordPress or is powered by PHP, check with your hosting provider and get it in writing that your version of PHP is up to date. If you know how to use Cloudflare, put Cloudflare in the mix because Cloudflare has a lot of these protections on

14:00 the DNS level before it even hits your server. If you want someone to help you out with that, I've got my contact details down below and I can definitely help you out there because our agency does a lot of this type of work. The other thing for developers out there, if you're using Node, if you're using Ruby, if you're using Lite LMM or any of these other systems out there, ensure that your versions are all up to date as well and patched for the latest vulnerabilities.

14:25 Now for all the crypto listeners out there, and I know there are many of you, this is the Learn Crypto channel. Check your bookmarks. Make sure you're accessing your regular websites where you normally go to trade or whatever it is. Access them via your bookmarks that are saved. Be sure that you are on the right website. Ignore emails that say urgent update or fix this fast or anything like that. Any email that comes to you with a sense of urgency. Stop, think, don't click on anything because a lot of those things could be traps for you that are set to entice you to go to those websites, make you panic, enter in your password, and then at that point, the hackers would have had your details and be able to log into your system. So

15:15 be very mindful of those type of scam and phishing emails out there. And I've seen an uptick of them because of the vulnerabilities, data breaches that have been happening recently with Tracer, Ledger, Keystone and all these other hardware wallets out there. So there's going to be a lot of those emails that are coming out over the next few weeks. So make sure you're always verifying the website that you're on, double check what you're doing, look at the addresses and check twice before you're sending any crypto assets.

15:44 So overall guys, the internet is not ending at the moment. It is definitely a turbulent time and we're going to see a lot of headaches over the next year or so. If you're a friend of a sysadmin out there or someone that works in the web space, give them a Red Bull. Give them a Monster Energy drink, whatever it is, because we're not sleeping much these days. We're out there trying to patch and fix and keep things running without being compromised. So buy me a coffee. I've got a buy me a coffee link in the corner. It doesn't just help support this show and channel. It'll help keep me up to secure the internet for you guys. So just saying, it's a great way to support the channel.

16:26 I've got YouTube memberships down below, but if you can't do any of that, just hit that thumbs up, like, subscribe, notification bell. Great way to support the channel and try and stay positive, guys. I'll see you in the next video.