Cybersecurity Experts REACT to the php chaos... (and MORE)

0:07 Good morning, hackers. Welcome back to the best podcast on the internet for hackers. The Lowdown presented by Maze. We are here in Las Vegas at Sentinel One's OneCon having a great time talking about the world of hacking and AI. We're obviously here at OneCon. We're in Las Vegas. We're at the ARIA Conference Center.

0:24 It's been beautiful. It's our first time both here. This is great. We had a great week. We got to interview some cool people from Sentinel-1. I'm going to be honest. I didn't have, I truly didn't have low expectations, but they blew my expectations out of the water, the interviews that we did. Yeah. They gave us some really good people to talk to.

0:41 They also ran an e-sports-esque competition of threat hunting, CTF. And I've seen people try to do e-sports, CTF-type things before. Hacking is pretty boring to watch. Hacking is so boring. wasn't even hacking this was threat hunting so i was like again my expectations were like uh i don't know how this is gonna go it was awesome it was great it was awesome they did a great job tight 30 minute uh on stage they had live commentators switching between monitors of like which flag people were working on they were explaining the process of like what people were looking at and working on fantastic fantastic we got to interview the winner of this the top threat hunter of the world right that's good it was they ran regional world uh

1:19 contest to do this they fed into this and then they did a live final here on stage super super cool so we're gonna cut the interviews into this podcast that we had uh and i don't think we're gonna do the full interviews in this episode we're gonna cut in clips of good stuff i really highly recommend you guys stick around for the rest of the podcast um but We're going to figure out a way to get these full interviews out, right?

1:40 Because they were just so, so, so good. We talked about the head of Sentinel Labs, talking about what their research that they've been doing and how they're looking into 2027 and the future and everything we just talked about. And also one of their execs and what they're seeing amongst all their customers and data and all this kind of stuff.

1:57 But geez, man. We had a lot of really good conversation and some unique perspectives, too, that are both, you know, they were different to me and helped me kind of reframe my mind from like the attacker mindset to the defender mindset. But also good conversation about the future of career and if it's important to even know the stuff anymore.

2:15 Super cool. Like, you know, a lot of stuff we talked about is like we're very nervous about. how do we grow the next senior cohort for the current juniors and how do we get the current juniors into the industry? And with all three interviewees, we had a really good conversation about what it even means to be in the industry right now.

2:31 Yeah. It was a really, really good conversation. I highly recommend you stick around. Super interesting on that. One of the other, so these are teasers, right? The other interesting bit that we asked both of the Sentinel one leaders, the attacker versus defender asymmetry question when it comes to AI.

2:47 Yeah, they both answered in a way that I did not expect and that most people do not answer today. That's my little teaser on that. And then there's also a few just like sound clip earworms that I'm going to be saying for the rest of my career. that come out that I want you guys to try to point out on what those were and why Matt has just been infected with phrases that I now need to enter into my vocabulary.

3:13 Matt, I have a problem. A bit of a personal issue to deal with. Just one? Well, a couple. But the one in the question today, every time I leave my house for a long period of time, something strange happens where... a vulnerability or two or three or ten drops and that happened this week so I are you aware of what's going on this week is this a pretty boring week in cybersecurity or what no what happened uh so so everything so so there may have been a major 10.0 CVSS and PHP there may have been a certificate authority where one of the private keys of their CA or of their intermediates was four uh and then the kernel of Linux has a couple bugs we're talking about as well and there's a long tail after that as well yeah we're gonna run out of

3:50 We're not going to have enough time to cover it all. But yeah, dude, it's so crazy week in the world of cybersecurity. We're talking on Thursday, October 22nd. I'm sure more will come out after this podcast. Yeah, but hey, I mean, this is just super cool. We're here. We're being spoiled by high quality video footage that we can't afford.

4:09 little youtube land so uh this is great um i i heard you like put out a video on php while we're i mean php stuff obviously we're gonna spend a lot of time talking about you went up to your hotel room and recorded i was recording in a booth downstairs making videos about this stuff um what like what the hell is going on what happened Yeah, so I mean, we, like I said, whenever I leave the house, big bug comes out.

4:31 Okay, so we're talking about PHP to shell. We land on Monday, get here Monday, and I think it was like Tuesday morning. There's rumblings on Twitter that a big 10.0 CVSS PHP bug comes out. And this is not a vulnerability in Drupal. This is not a vulnerability in WordPress. This is a vulnerability in the underlying PHP daemon that processes user requests.

4:53 Excuse me. Yeah. Excuse me. No one uses PHP anymore, though. I heard that. I heard that. I did a little investigating a la asking Gemini or Google or whatever. Turns out 70% of the Internet's forward-facing HTTP is processed in some form or fashion by PHP. So if, again, rumors, if a 10.0 CVSS were to come out on PHP, that would be very bad.

5:16 Tuesday... We learned that this is real. There is a small group of people, very close hold, that work in the InfoSec industry that are trying to figure out how to quietly and safely get a patch out for this bug that's very real. It is a use-after-free in the PHP daemon. Some leaks occur, some videos go viral, and eventually Kalief.io drops their report on how the bug works, and it truly is a remote on-off vulnerability.

5:43 Not easy to exploit. I think the 10.0 got downgraded to a 9.2, but a vulnerability in PHP as a result of it used after it freeing it in. So I think we got to talk about a few different pillars of this and how this week is gone. Right. I mean, we're laughing about it. Right. Whatever. It's kind of crazy.

5:59 Laugh pain away. Yeah. I think we have to talk about the vulnerability and exploitation. Right. Vulnerability, exploitation, exploits, AIs, you know, usage and creating all that. I think we have to talk about the leak. Right. And like all of that. And then I think we have to talk about what this pattern is showing us and like how this is going to impact the industry, because I do not think this is the last time we're going to see a week like this.

6:22 No, not at all. I think this is the beginning of many more of these. And that's not I'm not trying to like doom and gloom. I think this is just the nature of vulnerability research until we make code secure. And how that's even possible is a philosophical debate for a different podcast. But like, I agree.

6:37 This will continue. Yeah. So how about we, like, let's get on a level set of what the actual vuln is first. Yeah. And then I want to talk about kind of like, I'll go into the leak and the coordinated disclosure conversation and all this kind of stuff. Can you walk me through? I know you dove into the actual vuln, right?

6:53 I think it was rumors of it was 10. It's been downgraded to a 9.2, probably because of the ASLR stuff I think you're probably going to go into. Yeah. let's all get on the same page. What's the bug? So PHP to shell, right? This is the thing we give names to vulnerabilities when if you have that service, you can get a shell.

7:11 Congratulations, it's free. Now, exploitation of this is fairly complicated. What is the bug? The bug is... There's two, right? Yeah, so there's actually two. The Kalief researcher that found this was doing some research with LLMs looking for use after free kind of like failure invariants in PHP. So the first bug that he found only works on PHP 7.3, but effectively...

7:34 If you cause the PHP memory allocator to go out of memory, there is an issue where the teardown of that connection, the teardown of that session is not complete and the PHP session continues to run, which causes a use after free in some areas of the PHP daemon. So we took that pattern of something, something, fails halfway through, non-complete teardown, keep working.

7:55 And he wrote that into a skill.md file and said, hey, LLM, I think this pattern may be effective in more modern versions of PHP, go find it. And he did. The vulnerability here is the one we're talking about. The big one that dates back all the way to PHP 5.3, 5.2, I believe, which is July, 2004. So this bug has been dormant for coming up on 22, 23 years.

8:16 I don't want to know where you were. I know where I was. I don't want to know where you were. Yeah. Yeah. Fourth grade. Um, So the bug, the way it works, right? There is a lot of code, obviously, in PHP that deals with sessions, right? So in internet world, if you have a session, this is a way for the daemon to associate a request with an already existing set of metadata.

8:34 So if you log into a server, you're given a session ID, and that session ID associates this packet to the context behind the scenes. Okay. There is code in PHP that allows you to initialize a session with a file upload. Okay, so you're doing a multi-part data form, and there can be multiple requests that push up data to the server in the establishment of a session.

8:53 If that file upload is to fail, during the establishment of a session, there is a bug where there are pointers in global that still point to your request related to the session that get freed, but then later dereferenced in the teardown of the session at the end of the file upload. This is the classic case of the use after free.

9:13 We can have a whole separate class on like a use after free as I go into it in my video a little bit, I like what that actually means. But ultimately a use after free is obviously a primitive that can be turned into exploitation, but there are two problems with it. Not easy to do. You have to have another type that you put into the slot of the memory that is being used after it's being freed.

9:32 And two, this is a use after free in the heap. Okay. So you have to do this thing called heap grooming where effectively the next allocation is deterministic in the shape that you want. This is very difficult for two reasons. One, heap implementations vary across different platforms. I think PHP even has their own allocator.

9:48 But two, this is a network daemon. right? So this means that there are other requests that are running in the background that are manipulating the heap of the worker while you're doing your exploitation. So that adds to difficulty of even getting the user after Free Primitive to execute. On top of that, modern systems, looking at you, Citrix, um...

10:05 Have ASLR enabled, right? ASLR is address space layout randomization where effectively every page is allocated for a process. It's a randomized base address from the kernel so that if an attacker gets an arbitrary write primitive, for example, they don't know where to write the thing. Now, the problem with this is you have to free is apparently there are rumors of the POC enables you to do a relative read, which reads the heap addresses out, thereby bypassing ASLR.

10:29 But that being said, you know, back kind of to Matt's, we'll get into the rumor in the drama scenario. There's no actual public POC that confirms any of this. The only real like hard evidence we have is the video of the Kalief researcher running the exploit where they leak some addresses in there, but no one is able to reproduce that so far.

10:45 Yeah, but a lot of people think they have. And this is the pattern that I want to get into that I think that we're going to see a whole lot of from now on, right? Is this kind of thing has been going on a long time in vulnerability research, right? Where high-skilled attackers will find stuff and then low-skilled, well, not attackers, sorry, researchers, right?

11:03 High-skilled security researchers are going to find things and then kind of the lower-skilled side of things are going to kind of clamor and try to latch onto it, reproduce, whatever it is. This has been going on in vulns forever, and now in exploits, because LLMs are actually really good at helping in exploit dev, these low-skilled people are going to think that they reproduce the exploit.

11:27 Right now, as it stands today, Thursday, October 22nd, in the afternoon, because this could be completely false tomorrow, right? We're one tweet away from everything we're saying being out of date. Yeah. Where we are right now, even with the frontier model capability of exploit dev, which is very good, which is very good, I've only really seen high-skilled security researchers be able to actually produce exploits for bugs like this using LLMs, even using LLMs.

11:57 Yeah, look at the example for Kalief, right? The researcher that did this had to know, oh, this is the invariant pattern for a UAF. He had to document that pattern knowing it was a sane way to even look for bugs and then command the LLM to do it. Yeah, the LLM found the bug, but the researcher knew what he was looking for.

12:16 Right, totally. Totally. I've seen the expo team talk about like their platform and like using it to find vulnerabilities. And one of the slides that he has is kind of like how they do it. And one of the core pillars of using AIs in security research is gaslighting it. And it's like, yeah, you got to tell it that this phone is there.

12:33 Right. And then it actually can go find the vault. So even if you don't know it exists, you're like, oh, in this file, there is a use after free vulnerability. You've now gaslit the model. Oh, I'm so sorry. I'm going to go find it. I'm so sorry. And it actually works, right? But even just that little...

12:49 bit of like knowing the specific thing, how to look for it and where to look for it is still a, a thing of skilled researchers, right? For now, for now, for now, for now. Um, so the, the pattern being that I think that we're going to start seeing, right? More and more of that happened this week is the vuln info leaked.

13:06 And now everyone in the planet is, has a super-powered electron microscope that they can point at PHP now that they know that this is going on, right? And there's tons of ripple effects that happen because of this. One, we're gonna find other issues in PHP because the tool that we are pointing at it is good at finding these issues, right?

13:26 So even if they don't reproduce the thing that we know that this researcher found and has an exploit for, they're going to find other stuff, right? Number one, number two, a whole lot of people are going to get gaslit in the other direction. And their LLM is going to tell them why look at this, uh, siren emoji.

13:42 I have reproduced this exploit. Here you go. And it's wrong. It's a, it's, it's, it's the AI slop exploit. Yeah. Um, And this is what's been happening all week is these people are posting fake videos. They don't know if they're fake or not. Maybe some of them do, and they're just chasing clout. Alarm emoji, confirmed vulnerability, exploitation, like...

14:00 Right. And so now, and then, but the issue is because we were all on such high alert on this... And the normie media has no idea how to verify if any of this is going on. I'm still, as of right now, I was just reading stuff to get ready for this show and writing notes. I'm still reading headlines that there is successful exploitation, that there's POCs out there and all this kind of stuff.

14:22 And none of it is verified. Yeah, there's no truth to that. We don't have a single verified actual exploitation of this PHP bug yet, right? I do believe that the original researcher has a POC that works universally. Or at least in some broad fashion in order to spin up the mechanism that has been spun up with this whole industry on coordinated disclosure and fixing it and all this kind of stuff.

14:42 To be clear, the Kalief researcher, or excuse me, the Kalief write-up claims that they have a POC that they have gotten successful exploitation on PHP. WordPress, Drupal, PHP, my admin, like basically any modern CMS. A big one. They have gotten exploitation, all of them. If it's the same script or not, I do not know.

14:58 Again, this is a heap exploitation thing. So it may be a different exploit script depending on the shape of the heap per CMS. But someone somewhere has this bug. Yes. This pock. I agree, but I think a lot of the stuff going around Twitter is slop, right? And it's been verified is not working and all this kind of stuff.

15:16 But the headlines are saying that it's actively exploited, right? And this is hard. This makes this makes this whole week harder, right? Because you've got, I saw a comment on LinkedIn calling them narcissistic exploitation pimps. the low skilled people running around with these AI generated videos of exploits that aren't real.

15:35 And I think that we're going to start to see this pattern more and more and more and more, because if we're going to get, you know, what, what's, what's the next, what's next week Citrix bug that's going to come out. And we're going to get a bunch of people pointing LMS at Citrix and be like, Oh, I've got a POC.

15:47 Right. And, and it's just going to happen over and over and over again. Yeah. Um, the other bit that we can talk about here is how this whole thing went down and coordinated disclosure and all of that. Right. Hey, hackers, before we keep going, I want to take a quick break and say a quick thank you to our sponsors.

16:03 Today's Lowdown episode is sponsored by our friends over at Maze. Maze has spent the last couple of years using AI to find and remediate vulnerabilities in the cloud. And now they've released Maze Code, AI agents that find and deeply investigate vulnerabilities in your code. Now, we all know the deal.

16:21 Software composition analysis tools and SaaS toolings are all historically really bad at just making more noise. They find issues that may not actually be real and just create a lot of problems for your engineers to deal with that don't solve real security vulnerabilities. I get it. We've been there.

16:36 Maze code is a really cool tool because Maze code actually knows how your code works. MazeCode investigates every finding with the context of how your code is actually deployed. Sure, you're using a version of libxml2 that's vulnerable, but the actual code path to hit that vulnerability is not exposed in your Docker image.

16:55 MazeCode can find that and won't show you that that vulnerability is a big deal. Every vulnerability that Maze code reports comes with evidence that it's real and a way to fix it. Check out Maze at go.thelowdownpod.com slash Maze. That's go.thelowdownpod.com slash Maze. Thanks again, Maze. Let's keep going.

17:14 So the way that this works, if you guys don't know, used to run vulnerability management for large financial institutions, large social networks. I've been on the other side of this, right, where these volumes come out and it's my job to get the information, go find it on a network the size of France.

17:29 And tell the CISO when he calls my personal cell phone where it is, if it's on the Internet, if it's exploitable. This was my job. Right. So the stuff that goes on behind the scenes here is there there's information sharing groups of trust when a big bug comes out, not publicly. There's there's these groups that can kind of circle up.

17:48 share information on it, get a plan of action in place, get a patch in place, work with the PHP foundation in this case, get a patch in place, and then work with some critical parts of the internet, right? Some companies that run the backbones of the internet in order to try to get this fix out to the big swaths of like, holy crap, if this hit, right.

18:07 not PHP, but if another volunteer, if it hit Google or if it hit Akamai or Cloudflare or Nginx or whatever, could we get some of the critical stuff moving? Just give the insiders a bit of a head start is really what goes down. It's called coordinated disclosure. It's kind of part of the responsible disclosure ecosystem.

18:27 What happened is Uh, there's a member. What happened in this case is there's a member of that trusted group. That's the head of a cybersecurity vendor called chain guard. What chain guard does is they put out pre hardened builds and images of packages so that their customers are pulling from not the public repo of stuff.

18:47 When you like include a package in your code, you pull the chain guard one, or if you include a Docker image, you, you pull from the chain guard Docker image repo. Right. And they're, they're, they're pre hardened and all this kind of stuff. Right. So the CEO of Chain Guard, and I have his LinkedIn post up right here kind of explaining his thought process, and we can kind of cut this on the screen, is that he got word about this bug.

19:11 They started to try to reproduce it The way that he said that he was able to reproduce it is the frightening part here, right? There's some clamoring about how accurate this is. There's a lot of drama and ripple effects having to do with this LinkedIn post that we can get into. But he said that, hey, we got read in that something was coming in PHP last Friday by one of the original researchers.

19:34 That night, we were able to independently discover the same issue using our harness and a frontier model, which I've now since learned was Mythos 5.1, by the way. with a basic prompt of, quote, find bad vulnerabilities in PHP. Incredible. Was the prompt, okay? Obviously, his harness is doing a lot of work there.

19:54 Yep. But we're getting to the point now with Frontier Models that I think Even just a few months ago, harnesses were more important than the model when it came to security research. We're getting to the point that I'm seeing some people deleting a lot of their ClaudeMD files. A lot of the skills and setup, they're like, hey, start fresh.

20:13 Because the models have changed so much that you should try to raw use the model and see what can come up. That's not what happened in this case. I think the harness did some heavy lifting. But he looked at that. Then he said, we fully got read in Saturday. So Friday night, he thinks that they independently discovered the same thing.

20:32 They fully got read in on Saturday and confirmed that some of their findings from that really basic prompt were these findings. And he looked at that and said, I got to get a fix out. Like, this is too easy to find. I'm going to get a fix out. The issue here. And I don't think anyone... You know, there's like the... Did Dan do anything wrong here?

20:54 Is kind of this whole comment thread. The issue is he was read in under the agreement of embargoed information, right? So I think just like in general... I don't know. I think we can pretty much all agree he should not have broken embargo unilaterally without asking or talking to anyone or anything like this, because what this now did is force PHP to up their timeline by a full day.

21:18 A lot of the coordinated disclosure people who are waiting for that patch and had pre run incidents to roll the patch out as soon as they could downtime, maintenance windows, whatever it was that all those schedules were out the window. So the ripple effects of Dan's decision were wide. This has 147 comments.

21:35 on it and a lot of them are not very happy. Most of them are not good. Yeah, a lot of them are not very happy with Dan or Chain Guard and I do understand that. The question I have, okay, and I truly, truly, truly understand the frustration with Dan and his decision and all this kind of stuff, right? So I just want to say that.

21:51 I've been on the other side where this would have ruined my schedule and whatever, right? I'm looking at this and I'm... It's so hard for me because it's like I think we're in a different world. I think we're in a different world now, and we all have to realize that the old ways of doing a lot of this coordinated or responsible disclosure and vulnerability management in general are dead, dead, dead.

22:14 The timelines are so compressed from the time that any sniff of a vulnerability exists to the time that exploitation is going to start existing. I think this dream of having 90 days or even a few weeks in this case to get your ducks in order, I think that's behind us. Where do you land on this? I don't know how to feel about this.

22:35 Like, I think it's easy to be like, oh, Dan broke a rule, so Dan bad, like, Chaingard bad. But at the same time, I agree with your point, right? Like, we are in a different world where it is not a small group of, like, a hundred or a thousand people on planet Earth who are capable of, like, finding and exploiting this, so there is value in keeping it to a small group.

22:57 It is once literally a rumor that, of a vulnerability in something goes public. It takes like a nation state with a GPU farm or Billy with GLM53 at his house can point a model at the code base in question and find the vulnerability. And so, you know, whether it's bureaucracy or there's still a belief in a disclosure timeline, I don't know if it is the net positive anymore.

23:21 Yeah. So here's another post that I think this post by Kyle Pauly, who's the CISO at Perplexity AI, really, really helped me solidify my stance on this. Because I, like I said, I've sat on the other side of this. I've been a security researcher. I've disclosed vulnerabilities to vendors. And I've been the guy that got the warning that I had to go find all this stuff.

23:38 I've sat on both sides, right? uh even back then i it didn't quite sit right with me that like you had to know somebody to be in this little circle to like get invited and all this kind of stuff i made this video about the php thing pretty early right i had some people kind of mad at me that i made it pretty early like pandora wasn't already out of the box i understand okay maybe some people thought it wasn't helpful i don't think i i don't think i moved the needle i don't think i moved the I got so many DMs from people thanking me that they got a heads up.

24:10 Sure. They were like, man, this impacts me or some people at MSPs. This impacts so many of my clients. This gave me a little bit more time to prep for what this week was about to be. Right? And those kinds of people are not in that trusted room. Right. So that's hard. But I do understand like giving PHP time to fix, giving like the backbone of the Internet time to figure it out.

24:32 I do. I do understand it. But OK, this post from Kyle sees so perplexity helped solidify my opinion on this. He says it. I think he words it really well. I 100 percent agree that the embargo period for O days should never be broken by a trusted party. Period. I just agree. I completely agree. But I think the security industry needs to reevaluate how much time these embargoes could realistically afford to wait now that the cyber models exist.

24:55 Also completely agree. He's saying during the KVM escape, you made a video about this, right? They were some researchers on his team. They were able to independently discover the vulnerability within a few hours simply by giving a redacted tweet from the security researcher to a model. He's like, we, of course, respected the embargo period, didn't share details.

25:13 But if you can imagine if we were able to do it, any attacker could have done that as well. So ultimately, he said, ultimately, I think the embargo periods need to be measured in hours, not weeks or months. Completely agree. Completely agree. At this point, the hard part in vulnerability research is knowing what to look at.

25:30 Right. You can find bugs in anything. The hard part is what thing do you choose to find bugs in? Right. Oh, is it PHP? Is it Nginx? The minute you find out a bug is real in a platform, it just takes the right. We talked about this previously, the gaslighting of the model into find me the bug. No mistakes.

25:45 It will find you the bug. Yeah. So I think that, uh, I think this, this compressed timeline is really important. I think on the other side, I think if you're not like a security researcher or part of these embargo teams or anything like this, if you're running a security program for not one of the insiders that get added to this, right.

26:02 I think you need to really, really evaluate your security stack and your layers of defense and think, did this ruin my day? Like, if these kinds of zero days drop and they break you entirely, you need to really be looking at what kind of layers you have because I think zero days are going to be more and more and more and more common, right?

26:20 So we were talking today over breakfast about... This volume in particular is a little weird because what layer could you have put around like a PHP, internet-facing RCE? Like, that's hard, right? But other kinds of zero days, right? Citrix ones or gateway ones that we talk about a lot. If those don't go through a responsible disclosure type thing, if next week there's an Avanti Zero Day and it didn't go through a responsible disclosure and you didn't get a patch, what's your answer?

26:48 You need an answer. Like, you need an answer. It can't be, well, don't use that. It can't be pull that off the internet and it can't be, Yell on LinkedIn comments until people do responsible disclosure better. None of those are valid strategies. So what is your strategy? What are the other layers that you're going to put in place so that zero days don't just topple your entire stack?

27:05 Yeah. Right? There's no universal right answer. Your answer is going to be different based on your environment, all this kind of stuff. But like... This is our new reality. I want to talk about the kind of the zero-day fallout from all this, right? So we mentioned a lot of this kicked off because there were rumors publicly after this small group kicked off that PHP was working on a bug to fix a large vulnerability, right?

27:25 Yeah. When that rumor went live, obviously, we had the entire planet point their LOMs, DeepSeek, you know, 4.1, GLM 5.3, whatever, at the PHP code base. And so after the, you know, a couple of pocs were floating around, there are no public pocs, but there are rumors people have codes or scripts that could work.

27:42 And there are people that exercise the code path in PHP. People got the patch and then said, wait, there's a vulnerability that works for this patch. So two things are going to happen, right? One, there are likely going to be people who, while looking for this bug during the rumor, found other vulnerabilities in PHP.

28:01 And two, LLMs are very good at finding patterns, right? That's kind of like all they do. It's like you give it some data and it looks around in this little, you know, matrix cube and it gives you other data. Um... You know, the way that the Kalief researcher found the 5.3 bug, the 5.2, whatever the 5 version bug, is he said, hey, this is a pattern for an invariant, go and find it.

28:19 It is likely now that other people have found other invariants that match that same pattern. If you consider the LPE things from back in like May of this year... There was this one big bug called dirty frag where effectively a researcher found a new pattern in how Linux LPEs can execute, right? Local privilege escalations where you have a socket and a file descriptor for a privileged file like bin su, for example, or sudo or something.

28:45 And then via a syscall that does an out-of-bounds write, not maliciously, just like the way the code was written, you can overwrite the page cache entry for your binary bin suv so that the kernel thinks while you're doing exec VE, it has different codes. You run your code as root. That pattern of bug that the researcher found was then used by other researchers with LLMs to find new kernel vulnerabilities.

29:08 So in that same two, three-month period, they found six different CVEs that fit that pattern. So similarly, this PHP to shell is a interesting bug pattern. It's a use after free caused by something non-fatally failing during a session establishment, but then it continues to do work with that metadata.

29:27 It is likely that new bugs will be found not only in PHP that fit this model, but also Nginx, Apache, and name a network-facing daemon that parses requests. There are going to be new bugs, which is not super great. Yeah, and there's some other drama going around this one. Can you go through? I kind of missed this part of the news cycle.

29:47 What happened with Wiz? Yeah, this is more me trying to downplay this story. I really want to emphasize that it is so important for researchers not to infight. So what happened here is apparently Wiz got caught trying to buy the domain for PHP to shell and claim that they found the bug. like two or so days before the bug actually got dropped.

30:10 And there is this whole thing of being like, oh, screw you, Wiz. This is you guys trying to like buy up all the marketing for the bug and claim that you found it, okay? Two things. I think everyone now publicly acknowledges that the researcher from Kalief found the bug. That is kind of just like, they are like patient zero for this bug.

30:25 But to your point before, it is important to highlight that like, if you're a large company like Wiz, like Chain Guard, like somebody else that probably has access to a frontier, maybe unguarded model, like Daybreak or something, all you have to do is take the code base and say find me bug no mistakes and you're going to find it and so this may have just been whiz trying to capitalize on that which again likely is some form of like content marketing but either way i don't think this is them trying to say like we found it first it's just i think it was another researcher finding the bug that being said tldr here is like we're all in this together guys let's take it easy on the on the mudslinging we're trying our best

31:00 Yeah, I saw some pitchforks, right? People were like, oh, we're just trying to take, you know, claim responsibility on this or credit for this. And yeah, I just don't think that's what's actually happening. Yeah, it's not useful. All right. Are we good on PHP for now? Yeah. I think, okay. Like I said, we're recording this Thursday.

31:18 There's probably going to be some exploitation type stuff. The POC is going to come out. Yep. Like the POC is going to come out soon, right? Patches are not going to be 100% applied across the internet, especially I think 40% of that 70% is WordPress sites. They're going to have a bad couple days here, right?

31:39 Yeah. There was another just absolutely crazy foundational internet technology besides 70% of websites that had a really weird week. The analogy I made... So the next one we're going to talk about is the certificate of authority. The analogy that I made is like, this is like finding out that cement has a flaw in the world and needs to be remediated.

32:00 Oh, you're on a bridge right now, by the way. Yeah, by the way. And so is your grandma, right? Like, yeah. So... A certificate authority out of India, eMudra, messed up a little bit. And... Slightly. Used a private key. You made the joke at the beginning. Private key is usually tons of entropy, all this kind of stuff.

32:21 This one was the number four, I believe. Yeah. What the hell happened? And so it's not like the number four, like 10 to the power, like 1024 to the power of four, or it's like four D96 bits of entropy. All zeros... 4. 4. I don't even know how you would run a command to do this. Yeah. So again, there isn't a lot of detail that I can find about exactly how this went down.

32:44 And I'm going to be kind of loosey-goosey on details because I don't know exactly how this works. I don't run a certificate authority. But a certificate authority... is this thing in the architecture of the internet, right? Where you have TLS, you have encryption, right? You do a public key exchange when you're connected to a server, you authenticate via a certificate that the cert you get from the site is the site, right?

33:03 Like Google sends you a thing that is signed by a company that is signed by a company. The top of that is a certificate authority, okay? Okay. It's very important that the private keys for those certificate authorities, those certificates in the middle, they're called intermediate certificates, are not leaked.

33:16 The reason being, if you had the private key, you therefore could issue arbitrary certs at a lower level, right? So intermediate goes down one level, lower level, and you could use that key, that certificate that is trusted by the chain of trust to intercept traffic via TLS, okay? Now, how do you get a private key to be the number four?

33:36 I don't know. As far as I understand it, the certificate authorities, when they do key generation, they do what is called the key generation ceremony, right? These things are very trusted. It is very important that there is not a malicious third party, an insider threat. So there is a ceremony of multiple people that are pressing buttons, that are storing these keys in what are called an HSM, right?

33:55 A hardware security module. Candles are lit. Candles are lit. You got some funky jazz going on in the background. Tarot cards are pulled. Right. yeah i was going more the central route but i like yours better ceremony yeah um eventually an hsm is a hardware security module does two things one it creates cryptographically secure random numbers right a private key ideally is a secret random number that in the naming that in naming ceremony in the key generation ceremony none of us know it's in the hsm and it was generated securely The problem is, how could it possibly be the number four?

34:29 My guess is that, you know, ultimately the HSM is literally a PCIe card that's in a rack mount thing, and you have to write a script that interfaces with the HSM to issue the cert. I would imagine it was, like, a bug in their bash script that, like, just... Instead of using the number from the HSM as a private key, it was like the index of the private key, like I instead of K or something.

34:54 Again, I have no proof of this. I haven't seen the script, but it's just like that is the only way I could fathom a private key of four being issued either that. Or like in the manual of the HSM, you had to like seed the RNG. And if you didn't seed the RNG, like the seed was bad. So you just got like linear one, two, three, four numbers, maybe.

35:13 But that sounds like bad product design. I doubt that's the case. Either way, it's insane that that happens now. Yeah, it looks like it was an HSM wrapper script that during this key ceremony, that script just literally grabbed the wrong file that was labeled something different. The label was close, grabbed the wrong file, and gave that as the private key.

35:36 The bigger issue here is that this was in 2025. Yeah. Oh, right. We talked about this. Yeah. They did this key ceremony in 2025 and someone just figured it out. I think that we need to now include brute forcing private keys as just part of like our normal hygiene things to because we cannot verify that trusted certificate authorities are using secure algorithms and like you said, ceremonies to actually create these private keys.

36:06 We brute forcing private keys was not a part of anyone's toolbox. Right. It is like accepted that like to brute force a private key, it would like you have to achieve the heat death of the universe in time to break like RSA 4096 or something like that. Right. And so now we have to just do that really quick to make sure that, you know, in some really, really unreasonable fashion that this didn't go down.

36:26 That's kind of crazy. Yeah, I think the timeline of this, like, literally a researcher for fun was just, like, messing around with, he said, quote-unquote, I got some new toys and wrote a script to try to crack some stuff. So I pulled down some certificates from my trusted, like, search store. And then a couple hours later, I was like, oh, wait, whoa, whoa, whoa, I broke this?

36:40 And he, like, spent three more hours confirming that he cracked a certificate. And then he reported it to Mozilla and Google from there, which... It's kind of like the XZ backdoor where a researcher didn't like their 500 milliseconds of latency and discovered a global supply chain compromise. Kind of the same thing.

36:56 This guy was just fucking around and he's like, oh my God, the private key is four? What do you mean? This is bad. So the reason this is bad is that these trusted certificate authorities, if you guys aren't familiar how this whole system works, get preloaded into your browser, right? So just the fact that this is like some random intermediary in India really doesn't matter.

37:16 It really doesn't matter because this becomes a signing certificate that anyone could use in your browser would be like a little green lock up at the top left. A-OK. You can go on through. Right. So these are loaded into your browser. That's what the Trusted Certificate Authority system is doing. Right.

37:31 In Google and Mozilla's credit, this was killed within hours. Right. So no actual like impact from this one was very realistic. Right. This was nuked. Uh, the other, like just absolutely insane part is that Emudra has now like put out a statement and they're basically blaming the social media craze about this as like the bigger risk or the bigger part of like what actually went on.

38:03 Right. So they like in their statement, they're like, however, the level of the. social media amplification around this incident has brought scrutiny that is out of proportion. It's like, they're like, a significant amount of our revenue is from our certificate authority status. And like, this is making us look bad.

38:19 Stop that. And it's like, brother, yes, correct. Your private key was four. I'm not sure what else you would like me to say about that. Complete. So incompetence, right, is the actual thing and has nothing to do with social media amplification. I'm also seeing that we think that this statement came out and like why they're starting to say a lot of this is it seems like Google is going to revoke their ability to be a trusted certificate authority, which I think is completely valid at this point.

38:43 That's crazy that this has existed like this for a few years. Matt, I have a question. Are coffee shops dangerous or no? Yeah, so this is... We were sitting at a coffee shop, and I was, like, trying to wargame in my head how this is actually exploited, right? Obviously, this is bad. We know this is bad.

38:57 We understand this is bad. I was like, what's the exploit, right? So I very regularly dunk on... social media creators in the security space that just still push the public Wi-Fi bad, but right, right, for clicks. TLS has been around for a very long time. We have both said we will not take VPN sponsors because like they their marketing is very much like you need us to be safe.

39:22 Yeah, on public Wi Fi. I've made videos about this. Unless we're literally in like a totalitarian authoritarian government where you needed to like view the public Internet, you're not getting much out of it. And is a VPN helping in any situation that you're talking about, like a real risk is the VPN actually adding any additional layers of help for you.

39:42 Right. Because at that point, your your endpoint has spyware and it doesn't matter. Right. Like you're toast. So, uh, this is one of those situations that's very rare, but like, oh, wait, dot, dot, dot. Like if this kind of stuff happened, this does actually pose a risk for public wifi. Not necessarily public, like, like I wouldn't be really, really too worried about like, oh, people are like, oh, the airplane wifi is, uh, the hacker's playground, uh, you know, all this nonsense.

40:08 God, I hate it. Um, yeah. But the Wi-Fi pineapple attack is basically this works, right? This helps the Wi-Fi pineapple attack actually work without social engineering or without captive portal tricks or anything like that, right? Yep. The other scenario is a bit scarier, right? You were helping outline it to me, right?

40:28 What is like the internet-wide actual attack here? It's more nation state though, right? It's not like me, Matt, decides to be a bad guy today and want to exploit this E-Mudra thing that I found. My avenue is Wi-Fi Pineapple. What's the other avenue? Yeah. Yeah, I mean, if you look at historically big attacks on like, I'm talking global level routing protocols, like BGP, for example, right?

40:52 There are several instances of countries, and again, I'm not trying to get political, but like China is like one of the biggest perpetrators of this. They do BGP attacks where literally they have an ASN that does not serve an IP range. advertise that they do what they're doing is they're diverting the traffic of that internet through an area that you know the idea is that they can collect it right it's like suck it all down or whatever and ideally somebody's not encrypted or maybe they're like you know uh down or now store now to crypt later but in this case what could be done is an asn could use a now and the rogue is a wrong word but like a compromised certificate authority that your browser still trusts

41:27 They can man in the middle of that traffic and issue a certificate that matches your site that is now interceptable by them because they have the private key. And now your traffic is routing through an ASM that is malicious and they could be serving bad content to you, right? They can serve a browser exploit, they can do whatever they want.

41:38 Like that, that is the world of, you know, insane global level things that could occur from this. And that being said, China also has a lot of CAs themselves, so probably a different conversation. But still, that is the kind of thing that could occur. Totally. Okay. So yeah, in this regard, it's like, if this got found before Google and Mozilla were able to nuke it from orbit, a Wi-Fi pineapple type thing was a little bit more possible, basically, for the past year.

42:06 Right? Is that what this sounds like? Okay. Yeah. Yep. Just kudos to Google and Mozilla for absolutely, like, Yeah, this had zero impact. This was a funny meme on the Internet today. Zero impact as far as we know. Yep. I see Cloud Flares is all over it, too. It's just kind of crazy. And funny story. The tool men in the middle proxy now some more supports dash dash e Mudra mode.

42:30 We're able to intercept TLS and on the fly issue a cert for that site using the Mudra CA. Great. Incredible. Great. Great. Yeah. There were a ton of volumes this week. We don't have time to talk about all of them. That's how much there was. So we're going to play a little catch up on next week's podcast of all the volumes.

42:46 But we did want to talk about one more because near and dear to your heart, right? We were just talking about the number of Linux kernel vulnerabilities coming out, changing the security paradigm of containerization versus KVM and all this kind of stuff. What are actual security boundaries in virtualization and containerization today?

43:05 And what happened? on new Linux kernel vulnerability. Obviously, you've been doing a lot on this. What's this one? Yeah. So first of all, I want to highlight kind of a pattern happening in like the world of AI vulnerability research, right? So this is a yet again, you know, another use after free vulnerability.

43:20 Low level. Why do we keep seeing so many use after free vulnerabilities? The problem with the, what? Low level. Why do you... If a buffer overflow, something simple like a mem copy with a user sourced end is there, you're going to find it. Those are what we call spatial vulnerabilities, right? It is a buffer or a number exceeding the space of what is allocated for it.

44:06 A use after free vulnerability is a temporal vulnerability. It is literally a vulnerability in time where the program needs to execute two different states that are different, that overlap, that use the same code path, the same objects. fuzzers are not optimized for uafs they're literally optimized for just code coverage right but it's not it's not going to be like oh i want to optimize for go down this tree and then also in the same execution go down this tree and hope that those two overlap very bad And LLMs are very good at pattern matching, which is a thing that we're seeing in the UAF world where it's like, okay, if I can describe the ways this program can free over here in the same state, use that memory, if I can come up with this pattern, a lot of the, you know, the Kalief researcher, I can ask a LLM to go identify if that pattern of invariance can be violated in a code base, right?

44:57 So we're seeing a lot of UAFs fall out of the sky. And the two we're talking about today are vulnerabilities in the kernel SMB daemon for Linux, right? So two of them, one of them not super, you know, it's obviously a remote code execution bug, but it requires you to already have credentials within that network, I believe, to be able to actually, I think, mount a network device via SMB onto your Linux server.

45:19 But the second one is full on remote on auth, right? It has to do with basically during session establishment, if you tear down the session in the right way, there's a use after free race condition where as you're like walking a list, you can insert another node to the list and make it do arbitrary read, write stuff.

45:32 So not great. Again, I don't have a ton to say about this because it's like, you know, Yet another vulnerability in the Linux kernel. But I think at a higher level, what's more important to recognize is like, we're going to keep seeing more UAFs kind of fall out of the woodwork. Because I think people are learning more and more that LMs are very good at identifying that code pattern better than automation tooling like fuzzing has been for a long time.

45:55 Yeah. Yeah. This is crazy. We're living in a new world. It's changing, changing super fast. Anything else before we get there, guys, do us a favor. You know, if you're listening to this podcast, hit that sub button. If you're on Spotify, give us a five star rating on Spotify. I've gotten some words from our friends.

46:07 We're popping up organic in their algorithm, which is huge for the podcast. We appreciate your support there. And as usual, thank you, Mays, for sponsoring the podcast, helping us get this thing off the ground. Guys, we wouldn't be here without you guys. We appreciate that. Stick around for the interviews and we'll see you in the next one.

46:21 Later, y'all. Happy hacking. Good morning, hackers. Welcome to The Lowdown, the best podcast on the internet for hackers. We are joined today by Tom Hagel of Sentinel One, the lead of Sentinel Labs. Tom, how are you doing, man? How's life today? I'm doing good. Going to the conference. Playing? Busy?

46:47 Welcome to the fishbowl. Yes, the fishbowl is definitely a fishbowl everyone's staring at you, which is great. As long as they don't tap on the glass. Exactly. I'm doing good though. Keeping busy. So on attacker tradecraft, like hype versus reality, where are you seeing the most impactful differences in attacker tradecraft?

47:07 Obviously time to exploit and stuff like this that we're talking about. We watched the keynote yesterday. You guys were talking about React to Shell. You guys were talking about a bunch of different stuff. Yeah, it's like going to zero or negative numbers, right? Like the time to exploit a volume from when patch comes out.

47:22 It's like zero days are super common now. Besides time to exploit, what are you seeing be the most impactful differences versus hype that we're reading about? Yeah, the biggest thing right now is the reconnaissance capabilities for actors. Now they can have a prompt where they can figure out every organization that's responsible for being involved in this political case or every organization that's signed a contract with this software supplier.

47:46 So the reconnaissance capabilities are extremely robust now. And it's really hard to block that at a guardrail perspective from the LLMs themselves. Because you're just kind of... exploring the internet like, hey, who uses software? It's not like something that's going to trigger a normal guardrail that they can prevent an exploit generating.

48:06 I don't think we talk about that enough. Yeah, exactly. I don't read about a whole lot of that. Yeah, you look at the actors that are using it for that and automating that capability and then intertwining it with automated probing to see what's actually publicly accessible. And then once that's all said and done, then they go to the exploit route and think if they actually can do things.

48:25 The reconnaissance side is half the battle. You know, you think about, like, Chinese actors. They do a lot of insanely sophisticated hacks. Like, you think about, like, Salt Typhoon and all that stuff. Very, very sophisticated and well orchestrated and executed. But to do that properly, they had to do a ton of reconnaissance to learn about these environments.

48:46 It was accessible. Now they can automate all that stuff so they can find those little nuggets that are everywhere. This little contractor that's in Maryland that also supplies the cafe coolers for the Pentagon or whatever. Those little details are now able to be surfaced and that I think is the juiciest part right now.

49:06 You can't prevent that. Yeah, super interesting. We're getting lucky though because a lot of these actors are at least like the ones that are trying to figure it out are in the stage of doing it in a very sloppy way where you see like open directories with like all of their reconnaissance knowledge and tools and the prompts and all that stuff.

49:24 That was the South Korean stuff that happened. That was an open directory and pop it up in like census or valid in and you can see like literally their entire like lot MD file and everything they've been doing. So having a tool that documents everything that they're trying to do is pretty cool. I was actually had to spell it out like Steve was saying last night.

49:44 But that's going to change. You know, these guys are going to figure out like, oh, you know what? I probably shouldn't put this on a publicly accessible server with an open directory and whatnot. And then there's the sophisticated actors out there that are already doing this, but know better to like not make those mistakes.

49:56 So, yeah, long story short, I think the reconnaissance side is the best, but that's a good answer. Yeah, the exploitation side is interesting too, because it really started as like a phone apocalypse where like there's tons of vulnerabilities and like, you know, CVs are spiking right now and your iPhone gets like a thousand new updates every day or whatever.

50:14 We're starting to now see that shift where, okay, exploitation is now happening faster too. It's a more recent thing than like the actual discovery itself. I mean, that's the mythos, right? And we all knew it was coming. We all knew that mythos was good at exploitation and that everything else was six months behind it.

50:29 And I think it was actually only four months behind it. Yeah. My question is, how has AI affected the landscape of malware? From the diversification and signature diversity standpoint, and also from the malware analysis standpoint, right? Are those leveling up symmetrically, or is there so much more malware now to RE that you don't have enough smart people and LLMs to deal with it?

50:55 Yeah, I wouldn't say that malware itself has really hit its stride with a huge evolution in terms of sophistication because of LLMs. People are experimenting with it, and it's definitely speeding up the ability for people to generate custom malware based off of certain targets and stuff like that. So, you know, the old saying of a hash is useless beyond the first time it seems you can regenerate a hash?

51:17 Right. I think it's even more strong now that, like... you know, hashes and indicators of compromise around malware themselves are, you know, used once and it's kind of burnt at that point. So I think it's speeding up that process. But the reversing side and malware analysis side, I think, has evolved to new heights that I'm like super excited about.

51:38 You may have seen our research on like Fast 16 and some of the other stuff out there that More on the malware paleontology side, using these new models to do analysis and reversing on the samples themselves leads us to whole new discoveries. Especially like FAST-16 being like, was it 25, 6 years old or something like that?

51:58 Yeah, it says 2005 sabotage. Yeah, yeah. That discovery was just like, it blew our minds. It's like our favorite thing that we've ever done as a team. And that was purely because of LLMs helping us find these new things and looking at it in new ways. But they're not perfect. Reversing is being automated in a way for us with LLMs, but the real reversing and analysis skills still exist.

52:25 But it's still, it's opening a lot more doors for us and whatnot. And then obviously the detection side, if you're like actually trying to detect this product or write like our rules or SIGs or whatever. You know, like Steve mentioned yesterday, that's a huge important piece now. It leans best to like the behavioral side.

52:42 The actual malware itself, it's a, It's a messy game that we're all still trying to figure out at this point. And I think it's going to lean closer into reversing anything tools that have come out. I think you guys talked about those recently. Ah, fan. Yeah. I listen to that. Being able to reverse engineer somebody's really cool malware and make your own version of it, that's going to make attribution and like clustering based off of like what malware is like, it's going to screw it off.

53:09 Yeah, so we're in this world where we're hearing a lot about these AI attacks. And I think in this industry, we've acknowledged that typically defense lags attacking a little bit, right? We kind of figure out what the attackers are doing and make technology remediate it. Going into the future long term, and obviously this is a philosophy question, a Tom's take, right?

53:26 Yes. Does AI favor attackers or defenders? And with that being said, where does this go long term? Do we make a more secure internet or does everything fall apart? I think right now we are helping defenders more than attackers. Being able to vibe code my own toolkits or auto intake, like what's happening in the world right now to make it relevant to our organization.

53:51 I think that's so far beating what the benefits are to hackers, I think, today. I think long term, though, like it totally depends on on how things are going to unfold around the availability of open weight models and restriction of frontier model capabilities and hardware availability. If we want defenders to continue to have that advantage.

54:14 need to give them the capabilities to do it. You know, every nation state actor out there is building their giant GPU warehouse right now. If we start limiting defenders, let's say random people from being able to run an open weight model or guardrail them to defend their organization, like you're slowly taking away their capability.

54:33 So I think right now we're in a good spot, but over the next... oh gosh, let's say like a month to two years, it's going to, that changes and decisions we make forward are going to dictate how we go about it. But for me personally, I've never felt more capable as a researcher or anybody working in the cyber world.

54:53 I think there's a lot of fear around like, oh, it's going to take our jobs and it's giving bad guys all the superpowers, but like I've been building tools that I've dreamed about building for like decades now. And, you know, things that have cost a lot of money to try and get engineering resources to do and builds.

55:09 I'm not a dev guy. I can go buy above some crappy web app now and it gets what I need done. And, you know, it's private to me. And. And I've never felt more empowered from that perspective. So I feel very lucky on that side. But I'm also talking about DGX Sparks and Access to Frontier Labs. I'm very fortunate on that aspect as well.

55:26 Like somebody getting started isn't going to go drop 10 grand on a piece of hardware to run an LLM. Let alone paying $200 a month. Nor can a company a lot of the times afford to do that. Especially the small mom and pop water municipality in Minnesota, for example. Exactly. Yeah, so it's interesting.

55:41 We can't be waiting for a day or two after the intrusion to get access to Daybreak, for example. Where does that go with regulations, though, is kind of the question. Yeah. And I think a lot of this is going to make us challenge how we think about defense overall. Because there's the long... long history of us doing things where it's like antivirus, firewall, general security vendor technology.

56:06 I think we now have the capability to use this power to like really overhaul what we look at as like security tooling. You know, if it's like a whole new way of securing things before they get out, shipped out like PLCs, or if we want to get into like active defense where we start hacking things for defense across our country.

56:25 Like these are all possibilities though. Um, and I think we just need to like challenge the way we look at defense and not, and lean a little bit away from like the vendor categorization and naming and all that stuff and lean into like, how do we actually stop bad guys from doing this? How do we benefit defenders?

56:43 All right. Thanks for your time, man. Thanks, guys, for having me. Awesome. It was great. Thank you, man. We're here with Steve Stone, the chief customer officer of Sentinel One. Steve, how are we doing? Are we having an okay week right now? We're having a great week. Yeah. Great week. Thanks for coming out, guys.

56:54 It's awesome to have folks like you here with our event. So really happy to see everybody. It's been a good time. It's been a good time. Yeah, I know. Yeah, one of the phrases I keep saying a lot is that zero days are in invisibility cloaks. And now that zero days are getting cheaper, detections are more and more important than they ever were.

57:09 Because once the attacker gets on a system, they still have to behave like an attacker at some point. Right. And so if volumes are cheap, detections are more important. Right. I agree that completely. We right before one con, we had our CISO advisory board. It's our customer advisory board, but it's all CISOs.

57:24 And one of the things we spent a lot of time talking about was our experiences with Frontier AI. Sentinel one, we have access to all the major Frontier AI models. We use it in a range of ways. And we have learned an immense amount of things in the last year. Some things have really surprised us. Some things haven't.

57:40 But very much to your point is that is... One thing the Frontier models in particular are really good at that I doesn't get enough credit is it can find volumes all day long. You can read the marketing material. I don't think that was ever the bottleneck for attackers. I know that's probably a hot take in the industry right now.

57:55 I agree. But as a defender, we're able to do the exact same thing attackers are using these models for, which is find a very specific attack path that is a high degree of success. It's able to understand layers and paths that... That's troubling as defenders. That's a capability that used to be the remit of high-end government programs.

58:16 And now anyone with open AI can go do a lot of that. Well, we get the same thing. The frontier models are incredible at saying this is the, let's call it a vulnerability path or an exploit path, but that entire process to get to the end goal. And it's good at saying, if you pull this one piece out, the whole path collapses.

58:34 So now we don't have to remediate a thousand vulnerabilities to be secure. We can... do honest high end prioritization and say, I can't fix a thousand things. I can fix two things. And now I know the exact right two things. And I have removed that attack path. The attacker spent so much time developing.

58:52 We've never had a tool that did that before. And it it's real. We've seen it with our own eyes. Yeah. I completely agree on the bottleneck too. I say that a lot is, uh, that the number of vulnerabilities has been going parabolic, right? We've been seeing that in CVEs. Then even now kind of lagging exploit code on GitHub or exploit DB or any of these things is also going through the roof because we have models that can help write exploits.

59:15 But the number of vulnerabilities that actually get used in data breaches in a year has been flagged. So it's like, what is that telling us about what's actually happening to your customers or just the industry at large? We talk about that a lot. And I want to be upfront. This is an area where I could very well be wrong on.

59:29 We're still very much in the front end of this. But my position is having a gazillion new vulnerabilities changes almost nothing. We were behind on vulnerability and exploits as long as I've been doing this. So what's it matter if we're five behind or 500 behind? So that... That's part one. And part two is I completely agree with what you say.

59:49 If we, and we do, we measure this. We say what actual exploits are being leveraged in AI-driven attacks? they're almost never new exploits. They're exploits we've known about for years. So we're talking about this in one way, and that's not exactly the reality that we are seeing in intrusions. We're in some ways solving the wrong problems because it looks really good on a conference stage.

1:00:13 And it is amazing. We found a thousand vulnerabilities in five minutes. That's cool. That didn't change the physics of what we have. And the other part I'll say is, Here's what has not happened with all this fancy AI talk. There's not one new technique, not one. There's not one new methodology we have never seen before.

1:00:31 Now, maybe tomorrow I'll be wrong, but there are sheer physics of how cybersecurity and IT works. AI doesn't change that. You can't change the scope of the box. And we're seeing that. We're seeing it not change. So we know what to do in a bunch of ways. We just got to find new ways to come at it. That's super interesting.

1:00:52 So the question I was going to ask was like, you know, does, in your opinion, AI favor the attacker or the defender more? I feel like I've learned the answer you're going to give to that. And so I think I'm starting to come on your side with that, right? Where it sounds like from what you're seeing in the data that you have, attackers aren't doing much differently with AI at this point.

1:01:12 Like, you know, obviously we are finding more bugs. That's like a big thing on Twitter and all like the kind of the infosec like software security spaces. But from an actual operationalization of offensive AI, we're not seeing a ton of new fancy doom and gloom type technology. Correct. We are not seeing like, you know, the ghost come out of nowhere that no one's ever even heard of.

1:01:31 And we don't have a model or a concept for it. Like that's happened exactly zero times. Yeah. Now, so here's where I see AI deeply benefiting attackers. And then I'll kind of talk about why I think that's important and then answer your actual question. Sure, sure. I think AI, the biggest thing that AI is giving attackers is speed and scale.

1:01:51 And that's hard. Speed and scale is, as a cybersecurity vendor, we understand speed and scale. It is really difficult. It requires... Thousands of experts. It requires constant R&D. And that used to be the remit of big government programs. We used to differentiate the threat landscape, not just on a particular piece of code, but it's like this threat group can crank out code all day long.

1:02:14 They can understand and synthesize stolen data. They can do all these things. Well, now an individual can do that. It has raised the floor in dramatic ways. And then the other thing it's done, and it's very much in that same vein, it's given capabilities that used to belong to very few. And the example I always use is language.

1:02:37 And I don't mean coding languages. I mean written, spoken languages. Okay. The very first Iranian event I ever worked in my career, we were actually chasing a Chinese group. And we also found an Iranian group in the exact same environment. And ironically, the Iranian group actually had better technical access, but they couldn't read English.

1:02:55 And they essentially wasted the intrusion where the Chinese group maximized their access because they could understand. They could identify the right file. It was language. It was just they could literally read. And that sounds simple, but it is. AI solved the language problem for everybody. And it's now a capability that used to belong to linguists.

1:03:16 And you, you got to spend years training someone to speak Arabic and Mandarin and, you know, just go down the list. And now you do it with two tokens. That, that is a massive shift for the attackers. So I think those things really helped them on our end. We don't have to worry so much about all the languages.

1:03:33 It makes it complicated. It makes it more effective with phishing and some of those things. But we're back to the physics of an intrusion. The physics of the intrusion have not changed for us. And AI has allowed us to move faster through that. It's allowed us to understand environments much quicker than we could before.

1:03:49 And that's half the battle. That is, in my opinion, at least half the battle. And it's allowed us to move at a speed as well. And I think that's been probably the biggest limitation in cybersecurity. The hand on our scale, I think, is pushing that scale down farther. And the attackers are benefiting.

1:04:06 I do not want to say they're not. But the capabilities it's delivering to them weren't their limitations. And I'll go back to the vulnerability example. That was never the issue. That was never the problem for attackers. So they can do it way better. Awesome. Cool. It didn't move the needle for them.

1:04:20 Yeah, I love the use of the word cyber physics that that is one of my favorite terms in this industry, because it's it's a fun way of normalizing a lot of the verbiage we're going to throw around all over the place where it's ultimately like only a set of things can happen on a target. Right. And if we define things around that set of words, it helps normalize our conversations.

1:04:39 And so on that, I think what you're also saying is that, you know, they may be able to move at a faster speed and scale. it's not effective correct there's just so many there's so many paths in there's so many options there's so many toggles and that hasn't that has not changed yeah um so in order for your customers to meet the actual change which is speed and scale right uh their security programs need to look like the security programs that we've been trying to get you know, the industry to build forever.

1:05:15 Absolutely. On steroids, right. Is now there's, there's a whole lot less leeway on the speed that we've been trying to get everyone to move. Right. So you being the, you know, one of the main customer facing people at Sentinel one, Like what percentage of the customer base, or you don't have to give an exact percentage, but just like your experience around your customers are actually kind of doing the whole AI adoption thing.

1:05:41 The more I go out in the industry, the more I'm kind of nervous because a lot of people made up their mind about AI too long ago, right? They tried ChatGPT a year and a half ago, .com, right? Never really got into the cloud code, the agent space, whatever, kind of made up their mind about its capabilities.

1:05:58 Yeah. and are now maybe waking up to like, oh, you know, this is going too fast. I've also just been talking to people that are allergic to it. They don't want AI agents touching prod. You know, they don't want a whole bunch of things. And I'm nervous that people that have been allergic to it or made up their mind too long ago aren't going to be able to meet that speed challenge without leveraging the good parts of this technology.

1:06:22 Are you seeing that? Can you talk about that? Yeah, yeah, yeah. What's going on? Yeah, I'll give you an example, and let me give you, like, The kind of the two big things that keep me awake at night when we think about the totality of organizations on the operational defender side. The first example I would give is very much to your point.

1:06:38 We have customers asking us contractually to guarantee AI will not be used in their environment. We can't do that Sentinel one. AI is in our DNA. So we've never had people ask that before. We didn't start using AI last year. We've been using it for 12 years. That was not a contract challenge we had before essentially the last 12 months.

1:06:59 And that's essentially an organization saying, for whatever reason, we are going to intentionally exclude a really powerful tool for securing our organization. That's a hard problem. Like, we can't solve that. That's a decision. And that's a decision they get to make. And maybe they'll be correct down the road, but we don't.

1:07:19 We just approach it a different way. So I see two big concerns. One, I think there's going to be, and I think we're already seeing this, there's a rapid delta between organizations that understand AI and are using it smartly and organizations that don't, whether they're not using it, they've got inefficient models, they're using it for the wrong reasons.

1:07:39 And... That level of effort that it takes, I think, to be a great organization using AI, that's a high bar right now. That's not accessible to mom and pop trucking company. They do not have the resources to do that well. And that delta is getting bigger every single day. That is, AI has just taken that traditional problem and thrown gas on that fire.

1:07:58 That delta concerns me. I think we will see, if we fast forward five years... two completely different classes of organizations, and it's going to be hard to catch up at that point. So I think that's big concern number one. Big concern number two, people tend to approach AI as we interact with them. They want to go to the high end.

1:08:18 They want to go to Frontier. They Let me tell you a problem I've never had in my career before, but I have now. For the first time in my career, we have CISOs and CIOs coming to us and saying, I have to use Frontier AI. My board told me to. I've never heard that before. I've never heard a board say, you better use MFA.

1:08:37 You better, like, build a board. It's never happened. It's been the other direction. So there's this race to go to the high end. And that high end is... Highly expensive to begin with. It's not sustainable for most organizations. It's difficult to deploy and understand. And if you use it in the wrong way, you can actually do some real damage.

1:08:56 And the third part is it's a risk generating machine. If you point a frontier AI model at a code repo, you're going to get findings. Yeah. you may not be prepared to synthesize that down. And now you've got a document that says you are now legally obligated to fix all of these things and you're not qualified to understand that document.

1:09:16 We see that happen all the time. That's wild. So we actually see organizations taking a step back with the best of intentions where we would openly advocate for the opposite. Start with, we're back to what can we do with automation? What can we do with basic LLMs? That's very cost sustainable. It's very reliable.

1:09:34 It's very high efficacy. Now let's move into open-weight models, and let's start moving up the stack. And the example I would give here at SentinelOne, We AI is not new to us. I keep saying that, but like it really we've been in the space from the beginning. We have lots of AI experts. We have multiple AI teams.

1:09:51 We sell it. We use it. We provide I and AI to every one of our employees for their daily use. There's nothing we do that does not use AI. And we run into limitations because the models are changing so fast and the cost requirements, we're having to constantly evaluate models and swap them out. The multi-model is the only way we believe it can be effective.

1:10:15 That's a rare skill set. Harness builders, most people don't have a bunch of harness builders. They don't have people that can effectively measure models, especially against a specific workflow. That's grown up work. This hasn't existed. This hasn't existed 12 months, right? I mean, even new tools like JEV that just came out that is super cost efficient and fast to do model picking.

1:10:36 They've only been out weeks. You know what I mean? It's like, yeah, how could you possibly hire people that have experience doing this? Yeah, exactly. We have access to the main frontier models. We took two different models that came out within a week of each other. We pointed them at the exact same code repo.

1:10:52 We gave it the exact same commands. We only had a 30% overlap in findings. 70% of the findings were unique to one of the models. So now, not only do we have to deal with the findings, we now have to go study these models and understand and then eventually make decisions on which one we use for what purpose.

1:11:10 Right. There are not a lot of people walking around that are qualified to do that work. And if we are struggling with that as a native AI cybersecurity vendor, we're in the ivory tower. Like, let's not be cute. We have the budgets to do these things. If this is hard for us, it's got to be impossible for 90% of the organizations.

1:11:29 And that concerns me. Like, we have to solve that. We have to find a way to solve that for mom and pop trucking company. I'm going to quote you for the rest of my life now that I've never heard of a board mandating MFA. It's such a good point. I've never heard of a frontier model stopping a data breach yet.

1:11:46 You know what I mean? Maybe they have, but you know what I mean? But MFA would have stopped so many data breaches and yet... Because of the hype and the headlines and everything, you've got the ear of the board saying, are you using Daybreak? Are you using Mythos? I read about Mythos. I'm getting asked about Mythos at my daughter's soccer games, right?

1:12:04 I mean, we are fully out of the echo chamber here. I was referred to like the mom test. I grew up in the Midwest, great Midwestern family. My mom knows nothing about technology. She has asked me almost nothing about what I do for 25 years. I get asked about AI. I did an interview with the Reader's Digest on AI.

1:12:22 Like, what are we talking about? That's amazing. But that wasn't happening six months ago. Like, this is the world we live in. And I... At this point, I'm not sure we have enough of the right experts to institutionalize it at the scale we need to. And that's a hard problem. I'm really concerned about that.

1:12:39 And we have to solve it now. Really good point. Do you have anything we haven't covered that you'd love to get out? Like, you know, exciting stuff this week at OneCon. Exciting stuff that you're looking at to 2027. Really excited to work on here? Yeah, I would say the one thing I would leave. And I'll kind of keep beating this AI drum.

1:12:55 It's so hard to not. Yeah, put a dollar in the jar. I think. The things that we are bad at in cybersecurity before AI are all now all caps challenges. And I'll pick two as an example. I think the industry and organizations have universally struggled with identity. Identity. Yeah. And like now with AI, like the number and types of identity, it's off the charts.

1:13:19 Yeah. We were awful at that day in and day out as a whole industry before. We didn't get better at it with AI. So we need to solve it. And AI is going to actually help us solve that a lot. And the other is data security. And I'll go back to like, I talk with CISOs and CIOs all day. That's part of what I do.

1:13:36 If I walk in and talk to a CISO and say, how many endpoints do you have? That CISO can tell me that. Plus or minus probably 2%. If I say, how many cloud instances do you have? They'll have a pretty good idea, but they can be ephemeral. There's a little give there. If I ask how much data are you securing and how much of it is critical or regulated, the room gets real quiet.

1:13:57 And AI is powered by the most data you can put in front of it. So we have these two historical widowmaker problems that were always on the top of the list. And I think we have to just ruthlessly focus on these things that kind of sound boring because these will be the things. If we don't solve these now, we will never catch up.

1:14:19 This is what the attackers want. Always and nevers are dangerous in the threat business. I have never worked an intrusion that did not use illicit valid access. Not one. There's always a race to become a valid user. We just made that far more difficult to secure. And the end goal is access data, to steal it, to manipulate it, to lock it, fill in the blank, to understand it and change world events.

1:14:42 Yeah. We just doubled that pile that we couldn't suss through as an industry before. So it's so tempting to race to innovation. And I think we actually have to do the opposite. We have to race to fundamentals. And this technology will help us do that. It can really help us solve these problems. steve stone thank you for your time thanks for having me a lot of fun awesome good times we are at set in the ones one con with the current winner the world champion of threat hunting they just won the world tournament for threat hunting at one con jason how we doing man doing good yeah i'm playing how do you feel has the has the adrenaline from winning a ctf purge from your body yet are you relaxed i think the sign for that is starting to get hungry again and i'm not there

1:15:25 Okay, so no, not yet. Very cool. Well, man, tell us about yourself. So, you know, you just won the CTF. I guess my question for you is like, how long have you been in cybersecurity? And have you been like a CTF for a long time? How did you kind of get into this? So I'll go back to when I kind of started going towards cybersecurity.

1:15:39 It was COVID. I was doing graphic design previously, but I didn't really find my... There was like no passion in it. It was mostly just a job. So I went to community college, started in like IT, but eventually found like a cybersecurity program there. Founded a pool, went down it, eventually found myself in a SOC role, another SOC role, and now I'm doing protection and response stuff at a SaaS company.

1:15:58 So that's where I am. That's awesome. I've been doing CTF stuff for the past two years or so in the downtime, doing it with my team and some other friends. Nice. That's awesome. And so CTF, I think, kind of covers a wide variety of content, right? So you have CTFs that are like, oh, ponables, or like, oh, recon challenges.

1:16:15 Was this CTF similar to ones you've done in the past, or kind of unique in the way that it's like a threat hunting CTF? So I spend, I don't do a ton of red teaming CTFs. I'm definitely more like forensics, some crypto, mostly MISC, just mostly defensive stuff for sure. So this like lined up perfectly.

1:16:31 It's like what I do. Okay, awesome. And so at your current company, this is generally in the same wheelhouse as like your day-to-day. Exactly. That's awesome. Can you explain a little bit about how this one ran with like the regional versus today? Obviously, we just, you know, got off stage for the audience.

1:16:45 We just were in like the big keynote room here at OneCon. You're on stage in front of hundreds of people, live competing for half an hour, finding all these flags. But it seems like you've competed in a few regionals, at least one to get here. Can you kind of explain the process of how you got here? Yeah, absolutely.

1:17:03 So there's a few rounds of qualifiers before you then have to make it to the regional finals. The qualifiers you can compete in up to, but pretty much everyone does all four different qualifiers. They're kind of a similar style, like a 30-minute capture the flag in the same threat ops thing you saw on stage.

1:17:22 They're the four different qualifiers. You work towards your communal points, and they're four different categories. There's endpoints, there's cloud, there's AI security, and then there's their purple AI agentic STEM thing. So once all four of those qualifiers were done, they tallied up everyone's points, and the top 100, I believe, from each region there was a cutoff that got invited to a regional finals.

1:17:51 That was, again, a similar... Same Throne Ops portal, except it was very similar to what happened today. They had all four of the different categories combined together. And then the winner of that regional finals was me, Jody, and John Paul, who got flown here to compete in the World Championship. Awesome.

1:18:13 Awesome. And let me check my notes here. I saw a slide on screen that you got 97% of your flags in your qualifying rounds. Is that accurate? I'm very hesitant to put in a wrong answer. Nice. I like that. He's very sure of himself. I feel like that worked out today, too. Yeah. So for the crowd who didn't get to watch it, it seemed like there was easy flags, about 100 points, all the way up to fiendish, which was 1,000 points.

1:18:40 What was the most points you got in a single flag? I think today was 500. Nice. I didn't go for any of the finish. I looked at them, and I knew that they were going to take at least like five or ten minutes. Some of the intricacies of the Sentinel Run portal I'm not super familiar with, so if I wasn't sure I could go find it, especially with those finish, I was like, I'll come back to that later if I somehow finish all of the other 20 questions or something.

1:19:05 I kind of knew I wouldn't get to them. Yeah, yeah, that makes sense. I was just hoping the other contestants weren't getting to them. Yeah, I think Ryan, the MC, said one of the fiendish was like a 30 line or 30 parameter query on their platform that someone who works at Sentinel One, it took them five minutes to write, like five whole minutes.

1:19:21 So someone new to the platform, not necessarily doing this every day, I probably wouldn't spend the 10 minutes on that. I'm glad I didn't. Yeah, exactly. For sure. Yeah, it seemed like maybe one of the other ones was more of a data aggregation, like you would have had to pull a lot of data out and then compile it like out of the contest and actually do it like add some numbers up and all sorts of stuff.

1:19:38 And it's like, okay, are we popping calc exe in this ETF area? Yeah. Cool. Yeah. Yeah. So what was your favorite category? I mean, we had the four, we had the what endpoint, the cloud ops, the AI operations, and then I think automated stock, right? And what was kind of like your, I think the go to for most people started as endpoint, which makes sense, because that's kind of where, you know, we're all kind of native on the endpoint.

1:19:59 But other than endpoint, what was kind of your go to after that? And why? Definitely cloud, just because I'm more familiar in that area. Where I work, we don't use that cloud function. We only really use the endpoint one. And so most of my experience in that cloud portal has been from the other qualifiers and from last year's qualifiers as well.

1:20:18 Yeah. I just felt more comfortable with it. Sure. That makes sense. Yeah. Go to work. Go to where you know what you're doing. I think I did see, you know, you said you're hesitant to submit flags. I think you did get dinged on one today. So for the, how the scoring system worked was you get 20%, right?

1:20:34 And was that a fiendish that you tried? I don't think so. Okay. Yeah. Okay. And what, what happened? Um, do you remember? I do remember. So when you're inputting an answer, they give you like a wild card fake answer to kind of, so you know the answer you're putting in kind of matches linguistically or whatever.

1:20:54 But the answer that I came up with was the same as that example answer. And I wasn't sure if they were trying to throw us off or not. And it felt like something they might do. And so I input it. It was wrong. And I was like, okay, I don't know where I'm going with this question. Did you wind up getting it?

1:21:08 No, no. I was like, I'm done. Got off of that one. Okay, cool. So, I mean, this is a after the flag about threat hunting kind of, you know, positioned towards like the world of AI, right? We talk a lot about AI in our podcast, talk about AI in general. What's your AI hot take, right? Do we think that like AI truly is the end of the world in like the the threat landscape?

1:21:31 Is it kind of overhyped? Like, what do you think about it? And are you, you know, for whatever you can say, are you seeing it in your day to day activities at work? I'm definitely a long-term AI Doomer. In which direction? Doomer is what? That it's going to do bad things or that it's marketing doom? It's definitely going to do bad things.

1:21:49 But how bad things are or what direction that goes, I don't think we know. Okay, that's interesting. I feel like we're at the part where all of the current advances are somewhat obvious. It's clear that Red Team stuff is going to get incredibly optimized and incredibly... If you have a public-facing endpoint, etc., it might get popped pretty confidently, but unsure long-term.

1:22:13 Yeah, that's a conversation we have a lot. It's like, you know, the first thing people say is like, oh, these models are so good at finding vulnerabilities, exploiting vulnerabilities. The logical follow up is like, OK, well, cool. Well, they're probably also as good at defending. Follow up to that is then that like there's kind of like this asymmetric thing that we argue about a little bit where like attackers kind of go first and then defenders kind of do the thing after.

1:22:33 So, you know, is that gain that the defenders get symmetric? Is it going to truly remediate the issue that the models present? What do you think on that? I just don't, I don't think it starts. I definitely still think it starts with like corporate posture. It's like as a, as a stronger foundation, reducing attack surface is probably more important than having good forensic tools.

1:22:56 Okay. That makes sense. Yeah. We talk about that a lot, right? Like a, an AI proof security program is just a security program. Yeah, we've been doing all the things we've been trying to get you to do forever, right? You just actually have to do it because there's like steroids in the room now. What was the meme you literally just showed me?

1:23:12 If you have the editor put this in, it was like, you know, the soldier over the bed protecting the person. And it's like AI monitoring solutions and just knives coming in from the other direction. And it's like... you know, default password, like mini cats on exe, like all the basic things are still happening regardless of AI.

1:23:28 It's just now we have a new threat to also worry about. And the AI attack dart in the back was like a suction cup dart. Right, right, right. Yeah. So I also put a dollar in the AI jar and had an AI question. And so like besides the doom and gloom and all this, how has AI actually changed your job in terms of like detection engineering or anything like that that you're doing?

1:23:48 So prior to getting a lot of budget for AI, I've definitely spent a lot of my day manually tuning, manually doing thresholding, writing queries. And most of that is like a thing of the past in terms of that skill. I definitely feel like some skill atrophy when it comes to a lot of that stuff. I have the know-how and the thought bank on how this stuff needs to be done, and I can write it out all in natural language and have it done like how I know it needs to be.

1:24:17 But I feel like the actual meat and potatoes and the tradecraft, it's lost in there, for sure. And that's where I'm finding myself, because I can adapt it for almost anything, at least for an internal detection and response role, where I don't have to worry as much about... detections at scale, like at something like Sentinel-1.

1:24:36 Like I can go throw any detection for the most part at my internal company with 3K endpoints and I can deal with the ramifications if it's not tuned quite right or whatever. Oh, man, I can resonate with this, right? I've stared at like a big query, like box for way too long. I'm like, oh, man, I'm going to write this sequel.

1:24:53 It's going to be wrong. It's going to cost real money. It's going to take way too long. And it's like, well, I can naturally like language talk about what I want to do. So, yeah, that makes sense. That translates to the detection stuff as well. Um, so that kind of leads in nicely to like my last question that I had was what would you tell anyone trying to get into this field right now?

1:25:12 Right. It's obviously changed a lot even since you've been doing it because of everything that you just said. Um, so like what, like, what would you tell someone trying to become the world's next best threat hunter? I would say make sure you enjoy what you do because things are going to keep changing.

1:25:28 And if you're not passionate about learning, it's going to be a slog. Yeah. Because I think just the rate of change is so insane, like Moore's Law doubling every year, etc., Yeah, I agree. And how about the actual learning part? Do you have any like favorite resources? Was it like school? Was it search?

1:25:45 Was it just kind of reading about it? Hands on. CETFs, blogs, just kind of taking whatever I can get my hands on and then talking with friends on Discord. Yeah, this is how I, this is what I tell everybody, right? Some things haven't changed. It still sounds like CTF is the best way to learn how to hack or to defend, man.

1:26:01 That's awesome. I just tell people, I'm like, just learn as much as you can as publicly as you can. Right. I mean, like you just did an ultimate public learning experience. Right. But just like, yeah, be able to prove that you know it, like, you know, instead of a certification or anything like that.

1:26:15 Exactly. Right. Right. I feel like I will know already the answer to what I'm about to ask from you. But like if someone comes up to you and they say, like, is it still worth learning the fundamentals if AI can do it automatically? What do you say to that? You need to understand the fundamentals to understand the follow-up actions or the deeper, correct way to do things, I just could say.

1:26:36 Yeah. I have a fundamental concern about, we have people that are very talented right now that know the before times and the after times of AI, but it's like, okay, when that next generation has to come online, what happens? And I feel like this is kind of the sentiment that, oh, we don't need to know things because AI can do it for us.

1:26:51 And it's like, no, you have to know the fundamentals. Exactly. Yeah. yeah yeah cool that's all i had any more questions oh cool well jason thank you for coming and hanging out with us on the lowdown and thank you for participating and winning the you know competition for uh the world's best threat hunter man this is an insane trophy yeah congrats you're like i do not envy you getting that through tsa i think they said they were gonna help me out okay like yeah something like that Because that would be a bludgeoning weapon on an aircraft for sure.

1:27:21 This would solely put you over the checked bag weight limit. This is insane. Yep. Cool. Good job. Congrats. All right. Fine at all. See y'all.