00:00:00 · S0, Rebecca Balan, Tomer Schwartz
[00:00:00] S0: This episode of Equity is brought to you by Schneider Electric. Schneider Electric, your energy technology partner. [00:00:05] S1: Hello, and welcome back to Equity, TechCrunch's flagship podcast about the business of startups. I'm Rebecca Balan, and this is the episode where we bring on industry experts to help us explore a trend in the tech world and dive deep. Last week, a decades old piece of web software nearly took down a good chunk of the Internet. Banks, hospitals, retailers, government sites all pulled themselves offline to patch two PHP bugs, collectively known as PHP two shell. We talked about it a lot on the Friday episode, and our cybersecurity editor, Zach Whittaker, been all over it. But today, we're joined by someone who was actually in the middle of it. Tomer Schwartz, the CTO of Exposure Management and AppSec at Wiz. Tomer, welcome to the show. [00:00:51] S2: Thank you. Thanks for having me.
00:00:51 · Tomer Schwartz, Rebecca Balan
[00:00:51] S2: Thank you. Thanks for having me. [00:00:53] S1: Yeah. Really excited to talk to you. Sorry if I'm sounding a little sick. I'm not well today, so you might hear me sniffle or pant or blow my nose, but apologies for that. So just to kick it off, last Wednesday, for anyone who happened to miss it somehow, if you're living under a rock, I don't know. But last Wednesday, the PHP Foundation released patches for two critical bugs in PHP. This is the language behind WordPress, Drupal, Joomla and MediaWiki. So that's roughly 70% of the web facing Internet, which relies on this. Apparently, the bug let an attacker take over an unpatched server remotely with no password, no click, and security folks are calling it an unauthenticated remote code execution, which is just about as bad as it gets. You know, we've talked about it a lot. We came up with our own understandings of it. But I really want to understand from you, Tomer. You were in the thick of it. Can you set it straight? Like, what what about what has been reported so far? Are people not really understanding or are they getting wrong?
00:01:55 · Tomer Schwartz, Rebecca Balan
[00:01:55] S2: Well, think people sort of get it, which I'm really proud of the fact that we managed to communicate the importance of these findings. And to your point, it's as critical as it gets. Right? We're talking about a potential vulnerability where an attacker can completely take over the other side. If it's a... It's an externally facing web server, it can just use this in order to take over the the application, to access data, to access other users' data, to access credentials, and it is impacting the last twelve years of PHP deployment. So virtually any server that was deployed was affected until Tuesday or Wednesday when we released the patch. The other thing is that it's affecting default configurations. So it's a very, very common setup, which affects 70% of the web. The... This is why, there was so much drama around the publication and about the fact that people need to patch. [00:02:52] S1: So is the patching why people were taking their websites down? Like, there wasn't a fix yet at the time, and so they needed to take it down until there was one?
00:02:59 · Tomer Schwartz
[00:02:59] S2: Well, there's a lot of stories out of those forty eight hours up to the release date. We had a very concrete plan and a concrete timeline in which we were planning to release the information about the vulnerabilities along with patches. We also coordinated with a lot of different vendors and open source projects to make sure that they have releases available at that time. But unfortunately, information about the existence of the vulnerability leaked. At that point, we had to figure out what do we do with the original timeline, given the fact that if people know roughly where it is, they can all of a sudden scale up their research, find similar vulnerabilities, spin up AI models to look for the same thing. We eventually decided to accelerate the timeline, which meant that even though the PHP team was already on top of it and and with a a wonderful journey of a couple weeks of working on on those patches and testing them, in reality, it meant is that some of the downstream projects that needed to build new releases did not have enough time to build to build them before the the new release date. So in reality, what ended up happening is that a lot of different websites, lot of different government agencies, a lot of different companies were worried that once the patches are out, adversaries can sort of reverse engineer them and and find the vulnerabilities, which actually happened. And for that period of time that they knew that some of the releases... Some of the patch releases were not yet available, they decided to to shut down those websites.
00:04:32 · Rebecca Balan
[00:04:32] S1: Yes, Gary. Okay, so the timeline here was that you guys knew about this, right? So Calif is a research firm. They found the bugs, apparently, and these were verified through an OpenAI and Wiz initiative. You guys were planning to publish something about this, correct? And you had a timeline for when you were going to send out patches or update. And then it was actually leaked on social media, which created this crazy scramble. Am I have I got this roughly right?
00:04:58 · Tomer Schwartz, Rebecca Balan
[00:04:58] S2: Yeah. So a lot of different people participated in this research, and I gotta say that all of them are absolutely brilliant for finding this. It's kind of cool to see how different companies and different groups of researchers actually find similar things in parallel. My understanding of the timeline is that Calif actually found the first CVE, reported it to OpenAI. They realized they found some very similar variants of the same bug. They reported it to PHP together. And at the same time, in parallel, we had no idea about what's happening on the other side. We were looking into PHP at the same time we reported both CVEs to the PHP team. And it was the PHP team that decided to eventually say, hey, You know, this is such a critical finding. It's gonna take us so long to actually figure out what's the best way to to fix it. Why wouldn't all of us just join the same Slack channel and start working on this together? I think it was absolutely the right choice. We managed to do amazing work together. Honestly, I was fortunate to be on literally daily calls with the PHP team, with OpenAI and Calif just working together towards the patch. [00:06:07] S1: Yeah, must have been high adrenaline times for you guys. [00:06:10] S2: It was. I just want [00:06:11] S1: to double click on something you said, that a lot of different organisations found the bug at the same time. And you're saying this is because everyone's kind of using the same AI tools to do this, to search for vulnerabilities?