We really shouldn't be surprised about the PHPocalypse

Brandon: Hi everyone, and welcome to the latest episode of the Registers Kettle Podcast. I'm your host, Reg Reporter Brandon Vigliarolo. And hey, there's only one thing we could focus on for this week's episode, given all the hubbub around it, and that's the PHP apocalypse. Yeah, it turns out most of the internet is running software that could allow remote code execution on host systems. via a pair or as of today apparently three vulnerabilities that have come to collectively be known as PHP to shell. So that's not great. With me to talk about this is our security editor Jessica Lyons and open source reporter Liam Proben, who has a few things to say about PHP itself and why it's probably not surprising we're finding ourselves in this mess. Thanks to you both for coming on.

Liam Proven: Absolute pleasure.

JESSICA: To be here.

Brandon: Yeah. So Jess, let's start with the basics. What is this? How big of a problem is it? And where do we stand on on getting things fixed?

JESSICA: Great. Yes, so it's a the the short answer is it's a very big problem. So we have these two, they're related memory safety vulnerabilities, and they are in the PHP core. collectively they're called PHP Chichelle, and they affect every version that's been released in the last decade is is affected by one

Brandon: She's

JESSICA: or both of these, going back to about version 5.4. So The the general consensus is this is about 70% of all of the websites on the internet are running this code. So it's a yeah, so so it basically affects everyone at this point. so what happened here is that this this dates actually back to August. an independent researcher first spotted this, and then we can talk a little bit more later about who who found more of the exploits and and what

Brandon: Mm.

JESSICA: the foundation did with that. But so He he found this vulnerability. there was a coordinated disclosure process with the PHP Foundation, and then that broke a little bit starting over the weekend, and then onto Monday, there were some leaks. There was a video posted that reported to show this exploit. And so we get this emergency warning from the PHP Foundation. Late Monday saying, hey, we are going to be releasing these emergency patches. So everybody get ready so you can implement them as soon as possible. It's very serious. So by by Wednesday, they did release these, and there's this mass attempt to patch before any of the attackers get a hold of this and are able to attack websites with it. And but the the issue one of the I mean there's several issues but one of the issues too is that some websites are running really, really old versions and so they aren't able to patch. So they're just sitting there,

Brandon: Right.

JESSICA: these legacy servers are still vulnerable. And there's right, right. Right, exactly. And it's

Brandon: So there's no direct update path to for those old versions, right? It's basically shut this down and reinstall it kind of thing. Yeah.

JESSICA: it's really serious. So so basically they're both these memory corruption vulnerabilities and And it they exploiting them by exploiting them, an attacker can kind of shape the memory that PHP trusts. And then they can use that to hijack what happens next. And that can mean remote ac remote code execution. They can take over the the websites, they can steal data. And so people are visiting these websites they trust and they don't realize that the underlying code is stealing their data or delivering malware to their computer. and again, this is potentially seventy percent of the internet. So

Brandon: Yeah, I know quite

JESSICA: It's a big deal.

Brandon: a few yeah, quite a few sites were offline. I know even some big

JESSICA: Right.

Brandon: services like I I used to. I I stopped playing because I had a baby, but I used to play Final Fantasy Fourteen pretty religiously. And I know that the the entire login server was offline, you know, a couple days ago

JESSICA: right.

Brandon: because they had to they were like, you gotta fix this. Hey, sorry, no one can play the game. If you're not logged in right now, you're not getting logged in for the foreseeable future. It's just yeah, it's insane how much of the internet that's was a f that was affected by this. Now It's it's under exploit, is that correct? But but maybe not ex successfully exploited yet?

JESSICA: It's right. There's so so after the patches were released on Monday, or sorry, Wednesday, later Wednesday, AWS came out and said we've seen exploitation attempts at least four days before the patches were released. So that kind of caused another frenzy that my god, it's under attack, the whole internet is on fire. There hasn't been any successful attacks to date. There's been a ton of attempts There's a lot of POCs, some work, some don't. But as of it's it's Friday, according to the foundation and according to all of the security experts that I've spoken to, we haven't seen any evidence of successful exploitation. I don't think that means we're in the clear. I think it just means it's taking a while for for people and and honestly AIs to develop successful attacks, but that's where we are right now.

Brandon: Yeah, 'cause it's a complicated it's a complicated attack chain, correct?

JESSICA: Right. Yes.

Brandon: Yeah. So so basically, right. It's it this is not not working yet, but especially with some of these older websites that are running older versions of PHP that are gonna have to take a more, you know, thorough approach to getting this fixed and possibly going down for some time. Yeah, this could be this could be one of those problems that, you know, remains serious for a while. And let's not

JESSICA: Right.

Brandon: forget, some of these websites, that's seventy percent of the websites on the internet Right. That's almost three quarters of the entire internet. I don't know how many hundreds of

JESSICA: Mm-hmm.

Brandon: thousands of millions of sites that is, but some of those are probably never gonna get patched. You know, that's

JESSICA: Right. Exactly. Yeah.

Brandon: just the way it goes. Right. This is gonna be the sort of thing that we end up hearing about months or years from now when some, you know. Yeah. Yeah. I'm sure

JESSICA: Yeah years. I would yeah, I would say years.

Brandon: I'm sure there'll be some bank somewhere that eventually

JESSICA: Right.

Brandon: ends up getting getting you know, we'll we'll hear about some breach disclosure letter from the state of Maine. You know, in four or five years that yep.

JESSICA: And great, governments, local governments, federal and state governments, I I think these are the ones that we're gonna be hearing about quite a while from now. Saying, there's you know.

Brandon: Yeah, yeah. Cause that's like that's one of the things I was thinking about even in for me in my tiny little town in northern Michigan. I'm like, I wonder I wonder if my township or the county is gonna be all over it to update their PHP server. Does

JESSICA: Right.

Brandon: their IT guy who probably is a retired dude who lives in the area even know this is a problem? You know, it's just like it's it's it really is one of those things that yeah, it's a big deal, but if you're not kind of following the news on this, it could probably go completely unnoticed. And for many websites, I'm sure it will.

JESSICA: Right. Exactly.

Brandon: So so yeah, so yeah, it's it's it's it's pretty crazy. Liam, you're you're working on a story, I think, as we are recording this about some of the history of PHP and how it really probably wasn't very well designed or intended to become so ubiquitous on the internet. So so what's going on there?

Liam Proven: Yeah. I mean I I've seen one angle on this which of which is is people saying, you know, this is nineteen nineties code and it has nineteen nineties problems, which which is one way to look at it, but I'm I'm a nineteen eighties internet guy, you know, that's when I started exploring it. My my primary email address is older than the web. and it still works. my gods it gets a lot of spam, but it still works. But the I I've I've watched the rise and rise of PHP since the the first releases. Now I have no personal interest in in web development. ICANN program. I don't because I'm really bad at it. and and I d nobody needs to s have my code inflicted upon them, but the the guy that wrote PHP in the first place, Rasmus Leodorf, is my age. I I've never met him. I'm I'm sure he's a nice guy. but he he said in a in a very early interview about it that he said, I really don't like programming. I built this tool to program less so that I could just reuse code. and that that was About nineteen ninety three he he built a little tool that allowed him to put macros in HTML for his own website. And it's just grown. in a in a later interview he said something along the lines of, I don't know anything about writing programming languages. I'm just I'm just, you know, in I'm just you know, improvising this as I go and and people seem to like it. it originally stood for personal home page, I think, and later

JESSICA: Yes.

Liam Proven: was given a recursive acronym of PHP hypertext processor. This is a programming language that you mix in with the HTML of a website. It predates the modern model of of building websites where a a database is contains the text and a content management system of some kind assembles on the fly the pages that each Person sees this is an older model where you're running programs that are part of the markup language, which was not a good idea, but that was

Brandon: Yeah.

Liam Proven: how he did it. the there was a lovely blog post, and in case a friend of mine, I've got a an old friend who's an extremely skilled and talented programmer who has built a career on PHP and And he said to me, Look, those criticisms that you you've mentioned are of the really early versions and it's changed now. And if he hears this he's he's gonna be cross with me. But My favorite summary was from a a blog called Eevee way back when that called PHP a fractal of bad design. Whatever lay whatever level you look at it, it was done badly. If you look at the whole plan

Brandon: Some yeah.

Liam Proven: of let's just intermingle program code in with the markup language, not a good idea. if you look at the details of how it was implemented, not a good idea. If you look down at low-level details of how the Functions return values, not a good idea. inconsistent syntax, inconsistent functions, functions that do really weird things, by default no stack traces, not great error reporting. Now I'm sure a lot of this has been papered over now, but really there is one reason PHP is still around and still so big. Zuck. Facebook was built in PHP. And Facebook

Brandon: Mm-hmm.

Liam Proven: makes lots and lots of money and it's been throwing money at making PHP faster and more reliable and more scalable for decades. they've built PHP Yeah. They even built

Brandon: Have have they been big contributors to it? Or since yeah.

Liam Proven: a compiler for it, which I suspect is still in use. now how much of Facebook today is in PHP? I d I don't know, possibly none, but for a long time basically the world's biggest and busiest public facing website that wasn't owned by Google only because Google have failed to ever make a successful social network, was was built on PHP and it's big, it's complicated. like Linux itself, nobody fully understands how the whole thing works anymore and hasn't probably for decades. And now people have got bots that they can throw against it and ask them to analyze it. And I think this is probably just the first. And I think there's gonna be more. I think there's gonna be many more. A a a friend of mine who's a senior developer had had a look at the patch and he he's not a C guy and he s said I'm I'm quoting from comments on Mastodon that the The patch to the current version is 13,000 lines of C.

JESSICA: Mm.

Liam Proven: That's one that's a doozy of a patch. A bunch of

Brandon: that's that's huge. Yeah.

JESSICA: Yeah.

Liam Proven: people have been working like crazy for quite some time. And some people who've looked at this say looks handwritten to me. Others have said, no, I think this is bot generated. I think the truth is probably a bit of both. some from one, some from the other. But no.

Brandon: Mm-hmm. Bit of both, yeah. I mean, you can't pump out thirteen thousand lines that quickly, right? And have it tested. I mean, God, I hope they tested it, right?

JESSICA: Mm.

Liam Proven: Right. But that's just for the current version and and and this this

Brandon: Yeah.

Liam Proven: whole affects every published version.

Brandon: Yeah.

Liam Proven: So if they do manage to fix this one, how long till the next one comes along? Because I think there's gonna be

JESSICA: Mm-hmm.

Brandon: Yeah, especially with Yeah, especially with the speed at which vulnerabilities are being discovered now. I feel like every time

JESSICA: Yeah.

Brandon: I turn around, you know, I've written one Patch Tuesday article in the past few months, and you know,

JESSICA: Ha ha.

Brandon: that one broke the previous two records. And I think since then every month has included more patches, you know, and a lot of those are probably yeah. Yeah, that's insane. And you know,

JESSICA: Yeah. October at this point is the record, over a thousand for Microsoft alone. So right. Yep.

Brandon: that's that's insane. You know, it it it's yeah, I can't imagine if something like you said, it is it's is a fractal of bad design all the way down, is gonna probably have more vulnerabilities discovered. But

JESSICA: Right.

Brandon: I mean, seventy percent of all websites on the internet are using this. what can we what can we do? Are we stuck?

Liam Proven: Well so th there's a reason for that, and it's one that doesn't get talked about an awful lot, which is you know, Facebook aren't the only people that use it extensively, because WordPress is also built on

Brandon: Right. Yep. Yep.

JESSICA: Right. Yeah.

Liam Proven: PHP. And it's it's far from alone. Another senior Linux techie friend of mine g gave me a free shell account on the machine that he he runs for a few friends years ago, and I thought of resurrecting my old nineteen nineties hand coded HTML webpage for fun. And so I found it on the Internet Archive and I found a tool to scrape it and turn it back into HTML again. And I looked at some CMSs and I asked him if I could put a CM if there was any CMS on the machine. And he went, no. And I went, well would you install one? And he went, no. Well why not? And he said, well they're all all of them, all the big ones, they're all implemented in PHP. And I won't let

Brandon: Mm-hmm.

Liam Proven: that near any server I run. Well that that's a bit dramatic, isn't it? And he goes, No, that's pragmatic. I run a bunch of public facing servers on my own, and this is how I keep them secure. No containers, no Docker, no PHP, nothing built in anything of these tech these technologies. and I went, Wow, what about so I went looking for non PHP CMSs. There are a lot of CMSs out there. I I got a commission. about a decade ago to write a comparative assessment of the CMS market versus a company's proprietary Windows product. And I went and did a survey and I came back and said, I've found 1,300 so far. And they said, okay, we can give you five thousand words instead of a thousand words. And I said, Yeah, you you realize I'm gonna have to go and look at one thousand three hundred pieces of software here. Even if I only write three or four words about each one, you know, mostly harmless. I'm I'm still going to have to look at over a thousand bits of software. It will take me a year. And they went, Well how can

Brandon: Yeah, yeah.

Liam Proven: how can we do it quicker? And I said, Well you you can't. I I cannot do this survey you want. Give me a full time job and I'll get it back to you in a couple of years' time. I found a few CMSs that weren't built in PHP. Most of those were built in Ruby instead.

Brandon: Mm-hmm.

Liam Proven: And he went, Yeah, I'm not keen on having that on my server either.

JESSICA: Mm-hmm.

Liam Proven: So it it it's not even a case of people that have PHP deployments that they're gonna need to update. They don't know. They built it on something else which was

Brandon: Right.

Liam Proven: built on something that was built in PHP. It's

Brandon: Well then I

JESSICA: Well and then

Brandon: you know it

JESSICA: and

Brandon: it go ahead.

JESSICA: I was just gonna say, Liam, you said, you know, in well, how long until the next one happens? And we found out today from PHP Foundation that there is a third one. They won't be pushing an emergency release for this. They said it'll be published with the next regular release cycle. the the foundation told me that this one, quote, requires a very unlikely combination of configuration and specific PHP application code. which we do not expect to occur in practical use. So, so there's already another one. But well, I

Liam Proven: So weeks then.

Brandon: Yeah.

JESSICA: mean, and then, you know, even even with this, it's it's it's hard to exploit. It's this you can mitigate it with a configuration setting. But that was part of the thing we've heard with these other two. And then we did have researchers yesterday who developed this new exploit. Vol this was Volcheck. And that shows how that even ASLM or sorry, ASLR can be bypassed to attack these vulnerabilities on X eighty four machines. So it's not you know, saying no it it can be fixed with a configuration setting, that's not always a guarantee.

Brandon: Yeah. And I mean, now that also honestly that that brings me kind of to the elephant in the room of this whole story, right? And that's AI, right? 'Cause of course it all comes back to AI nowadays, right? Open AI and the other two so open AI was one of the security firms that reported this. and I think there were two others as well. And I think Jess and one of maybe it was your story or one of the ones Lindsay wrote, they all you they all said that they used AI to to find this, right?

JESSICA: Right. So so the the c the companies, so Khalif and they are a newer startup. They are AI pen testing and they're part of OpenAI's partner program. So they used OpenAI models, working with OpenAI

Brandon: Yeah.

JESSICA: to find this. And then independently, Wiz, which is owned by Google, also did. So this happened back in August, and then they have been all working with the PHP Foundation on the patch since that point. But yeah, this is they have all said this is a these are vulnerabilities that probably wouldn't have been found by humans alone. This these aren't these they've by all accounts existed for decades. They wouldn't have just been found by human researchers.

Brandon: Right. So either these are things that have never been discovered and would have never have been exploited theoretically, right? The the the exploit path is complex, right? They're not obvious vulnerabilities that they needed an AI to find. Or or perhaps this is the kind of thing that was known about but was privately held in the hands of some bug hunting company that sells exploits to governments. You know, who knows? Maybe that's the case, right? I remember talking to a guy one time at Black Hat who basically said, Yeah, his company's in the business of finding really sensitive vulnerabilities and then selling them to the highest bidder. You know, so there are there

JESSICA: Mm-hmm.

Brandon: are companies like that, right? That exist. And so there's probably plenty of vulnerabilities in software that's well known that we don't or that not w that is not well known, right? That exists that it that that governments and high level functions are are are aware of. But in this case, this this probably probably wasn't the case, right? This is an incredibly difficult to find vulnerability. You know, I've seen a lot of chatter online in the past few days about You know, God, like you said, Jess, the internet's on fire. it's the AI bug pocalypse, it's arrived. You know, it it seems like we're we're we're having another case of like, okay, yeah, people are getting all freaked out because this is the end of all this is the end of time, you know, history is over, AI is gonna kill us all. And it just seems to me like this is another example of well, maybe not. Like this has been getting hammered by by potentially bad actors or pen testers. And no one's managed, as far as we know, to successfully you know, successfully use this yet. Is this is this as serious, you know, as it seems, or is this another case of like, yeah, this is a serious vulnerability, but it's one that that is so complicated and so you know, convoluted that i you know, it's not really gonna be that that big of a deal, right?

Liam Proven: Want note parenthetically that you described OpenAI as a security company, and if I had been drinking coffee, that would have been very bad for my keyboard. Caliph

Brandon: okay. Whoops, let me take that back.

JESSICA: Ha ha ha.

Liam Proven: is interesting because I just just wrote about them.

JESSICA: Yes. Mm-hmm.

Liam Proven: They they found a hole in OpenBSD, and there aren't many of those. And

JESSICA: Mm-hmm. Mm-hmm. Right.

Liam Proven: only about a week ago they found a hole which they dubbed Big Fish in OpenBSD. and it was just days before OpenBSD 8 shipped. It looks like that had been there for thirty-seven years, which is a neat trick because OpenBST was founded thirty years ago. So this

Brandon: Ha ha.

Liam Proven: is this is in gonna pronounce this carefully, Berkeley system distribution Unix in in the eighties. but yeah, that that there are doubtless more, and I I'm an arch AI skeptic. peep peep Some people will claim that this will be a sort of problem that you can solve with AI by getting it to rewrite your stack. Well yes, but then you'll replace it with a new stack that nobody ever understood any of. but the there are ways to design and host and run websites and forums and chat channels. without using any of this stuff. And it could be a net positive if holes like this keep getting found that people will be forced to go back to I know, sounds crazy, but you know, static websites serving pre

Brandon: Mm-hmm.

Liam Proven: written code off a disk. And one of my favourite websites of this is that I I recently discovered there's a whole chain of them and and I hope you won't mind me swearing, maybe you have to beat me. But there's a marvellous website called This Is a Motherfucking Website and It's Perfect. And and recently somebody rewrote it and the new one is looks almost identical. This is a modern motherfucking website and it's perfect.

Brandon: Mm-hmm.

Liam Proven: And he's he's written it with with more CSS or something, but apparently there's whole chain of these things and they are extremely low on programming code. And they contain interactive elements that you can do with just HTML, and you don't need a whole web framework behind it. And you know what? The the same AI companies are busily scraping the whole web multiple times a day to feed their training engines. Well, maybe we just have to suck it up, scrape some of these big websites, and redo it as simpler tech. With fewer interpreted languages. We we are all collectively victims of the sunk cost fallacy. We've got millions of websites.

Brandon: Mm-hmm.

Liam Proven: We spent billions and trillions of dollars building all this. We can't just throw it all away. Well, maybe maybe you have to. Mm-hmm.

Brandon: Yeah, sunk sunk cost was something that kept coming to my mind as I was,

JESSICA: Mm-hmm.

Brandon: you know, as I was writing up the sort of script for this episode and just kinda thinking about this. I was like, We it seems like a whole big case of like, well, all the websites in the world are now on PHP, so I guess we're stuck, you know. Well, not a not a formal script, just like notes,

Liam Proven: We have a script?

Brandon: right?

Liam Proven: Get the memo.

JESSICA: I mean, I think I think that's part of the problem though, is that it does illustrate this larger at AI in general, AI bug hunting and exploit detection kind of illustrates in general this bigger problem about the internet and especially these legacy systems that underpin you know government services, critical infrastructure. It is just literally held together by duct tape and and string. So it's it's a it's a massive problem. I think again, it's you know, it takes some work to actually make anything of these vulnerabilities and chain them together. And AI is getting better about that. So but it's it it definitely whether or not this ends up being the end of the world for the internet as we know it, it does illustrate a a real problem.

Brandon: Yeah, yeah. Like Liam said, right? It's it's you know, maybe this is the sort of catalyst that the wider internet community needs to kind of realize that these systems, these this duct tape and string, it simply won't work. Won't keep working forever. And we need to maybe modernize all the underlying infrastructure,

JESSICA: Mm-hmm.

Brandon: you know, and and make it simpler and make it less, you know, cluged together, all these different things over the years. Like I mean, like you said, PHP is is Poor design all the way down, right? It's like, well, maybe we need to tear it out and start over. You know, yeah, even if these vulnerabilities are impractical to exploit and hard to find, you know, the fact that they're being discovered does illustrate that most of our code is a mess.

Liam Proven: I I am I am reminded that the other day I was talking with with in the in the comments about AUX, Apple's original Unix for the Mac.

Brandon: Mm-hmm.

Liam Proven: and and Apple paid another company to develop AUX because the US military had a tick box on the form that said w to buy systems they have to be able to run POSIX. And the US Army at one point hosted its website on Classic Mac OS. And they used, and it wasn't exactly security by obscurity. They said virtually all web server attacks in the mid 1990s were based on getting a remote shell. And classic MacOS didn't have a shell at all, anywhere. So there was no way to get a remote shell because you couldn't get a shell if you were sitting in front of it. So they said, you know, they they try and inject bits of x86 code. Well, it's not an x86. They try and get a shell, it hasn't got one. They try and get it to run scripts. It doesn't run scripts. They said we just sit there and watch people throwing themselves at it. All the best attacks and none of it works because the operating system's kind of too primitive to do any of that stuff. they they I don't believe many customers actually ever used A UX, but it got it got Apple some lucrative deals. maybe we're gonna we're gonna see a new trend of of super primitive, super basic websites that there'll be a new difficulty in trying to scale the things because Kubernetes expects a lot of this to be sort of dynamically generated by microservices. But bring it on. I'll I'd love to see that.

Brandon: Yeah, maybe that's a problem. That's a Kubernetes problem, right? Yeah, it's

Liam Proven: Yeah.

Brandon: just I I feel like that would be I mean, I would love a simpler internet, you know. it would be it'd be amazing if I could just, you know, wake up in the morning, go to a news site and just get the headlines. You know, I feel like so often, you know, and I I I think the register is good at having a relatively simple design, but You know, so often I feel like the the news aggregators that I go to, I look for ones that are as minimal as possible. I look for

Liam Proven: Exactly.

Brandon: websites that are simple, right? I don't need all this in your face stuff, right? It's not necessary. I think we probably are all pretty sick of it in a lot of ways.

JESSICA: But I mean, do we really think this is gonna happen though? It I

Brandon: No.

JESSICA: I feel extremely pessimistic about this. I think it's much more profitable to just keep marketing solutions to the problem as opposed to a safe coding overhaul.

Brandon: Yeah, unfortunately.

Liam Proven: G geopolitics might yet get in the way. I I I wrote a piece about the OpenEuler. It's one of the big Chinese enterprise server Linuxes. one of only two companies actually showing off an OS at at the open source summit. And the other was also Chinese. It was Open Keelin, which is more desktop focused. China makes its own chips, China makes its own operating systems, it's got its own programming languages, they're all open source, they're all taken from from European and American developed software by and large, but they could still invade Taiwan and cut off much of the world's chip supply. And suddenly it won't just be that memory is way more expensive than it used to be. It will be that you can't get more memory

JESSICA: Ha ha

Liam Proven: anymore and you have to keep using 10-year-old chips. and people will be possi t potentially forced to find ways to keep getting more out of the same hardware until we can build

Brandon: Yeah, I mean

Liam Proven: new chip fabs, which will take a lot of time and a lot of money. And then quite possibly they'll get blown away in a climate change induced hurricane and then we'll have to start again. So you know, I hope they're gonna start building them in the north of Norway and places like that. But

JESSICA: Mm-hmm.

Brandon: Yeah.

Liam Proven: y yeah we've we've got bigger problems coming down the pipe and and and

Brandon: Mm-hmm.

Liam Proven: it's all a giant Snowball of of superficially unrelated things. AI attacks on overcomplicated stacks on one side, and the other kind of attack which involves whistling noises and large explosions on on the other side, which cuts off the hardware market and it's hard to plan for this, but nobody's even trying yet.

Brandon: Yeah. Well, gee, who would have thought a talk about a PHP vulnerability would have turned into

JESSICA: Yeah.

Brandon: geopolitical chaos and the end of the end

Liam Proven: Right?

Brandon: of modern technology as we know it. Break out the sundial, people. All right, guy. Yeah.

Liam Proven: Excuse me, I've just got to go and wind the web server. Hang on.

JESSICA: Yeah.

Brandon: All right, guys. Well, thanks for coming on. I think this was a really valuable discussion and it shows just how interconnected all these issues in tech are right now, right? I mean It's a it's it it is interesting how we're kind of hurtling toward this something, I feel like, in a lot of ways. And and AI will surely be a part of it, as will expensive chips and lots and lots of vulnerabilities being found every day. And hey, hopefully we'll still be here to cover it, you know, a as that continues to happen. So be sh

Liam Proven: Yeah.

JESSICA: If AI doesn't kill us.

Brandon: Yeah, right. If AI doesn't kill us all. Well, if it doesn't, we'll be here on the kettle to talk about

JESSICA: Ha ha ha.

Brandon: it. And we hope that you from whatever bunker you're hiding in will join us on

Liam Proven: And

Brandon: future episodes.

Liam Proven: yeah, we'll be publishing a telephone number so you can phone into future cattle episodes.

Brandon: All right, folks, we'll talk soon.

JESSICA: Wearing your tinfoil hat.

Liam Proven: yeah.