00:20:00 · Tomer Schwartz
[00:20:00] S2: Well, there are many parts of many code bases that for those who are very familiar with these code bases, they can say, well, this area is a little more sensitive than others. But there's a big difference between a a simple bug, a QA issue, if you will, and something that can be leveraged by by attackers. It's it's it's very different situations. I think that even though, you know, information about these kinds of problems have appeared as early as 2020 and and even before, and when we talked to the PHP team, they said that they're... They were thinking about this particular area as a somewhat problematic area. No one could have built an exploit for this. Right? No one reported that they have a fully working exploit that manages to trigger these bugs remotely in a reliable way and in a way that can be abused by attackers. I think what happened is, again, it goes back to AI. Now that we can not only spend our time and energy, but also spend a countless amount of tokens and cognitive load that we can of move between different ideas. It gives us the ability to scale and try to build exploits in a much much different way. So I think what happened is that all of a sudden, Us defenders have such great tools to be able to try all of those things and and and cover the basics, if you will, and all of those potentially sensitive areas that we can surface a unique set of of new vulnerabilities. Right? And and this is why we keep saying that this is not the only critical vulnerability that is about to be published in the next couple weeks or months. Right? I think that we... The industry was used to this yearly cycle where maybe we had a one headliner per year of, like, the the most critical vulnerability that was found in that year. I I think that cadence is very quickly changing.
00:21:54 · Rebecca Balan, Tomer Schwartz
[00:21:54] S1: Yeah. We've been hearing about this, right? And this kind of feels like the canary in the coal mine in terms of how safe the Internet can be, like what will come next? This is clearly the first of many. Is there anything that, you know, well, first, before I actually ask for like, what can any of us do with PHP in particular, is still unpatched? You know, Zach had said that smaller IT teams, solo devs, like anything that bundles PHP like routers, storage devices, firewalls, dev tools generally are still unpatched. Then there's like the legacy systems that can't be updated. So, you know, who's at risk? Who should be taking a closer look? [00:22:33] S2: Well, anyone who did not patch in the last couple of days is currently at risk. And we're monitoring this every single day either with the the Wiz customer base or with broader scans that we're doing over the Internet, and we're seeing that still a majority of of workloads are not patched. It takes a lot of time to actually fully patch a live website to to figure out that... You know, what's the right way of doing this, to understand who the owner is, to make sure that the releases are actually installed. I do worry that we're going to see this tale of unpatched systems for quite some time now.
00:22:33 · Tomer Schwartz, Rebecca Balan
[00:22:33] S2: Well, anyone who did not patch in the last couple of days is currently at risk. And we're monitoring this every single day either with the the Wiz customer base or with broader scans that we're doing over the Internet, and we're seeing that still a majority of of workloads are not patched. It takes a lot of time to actually fully patch a live website to to figure out that... You know, what's the right way of doing this, to understand who the owner is, to make sure that the releases are actually installed. I do worry that we're going to see this tale of unpatched systems for quite some time now. [00:23:11] S1: So anyone that's not patched, any website that's not patched, there's lots of small businesses that are using WordPress or Wix or GoDaddy or whatever, like hosting platforms to build their own websites. Is it only a problem if they're based on PHP? Like, can those people rely on those companies, those hosting platforms, website builders to fix it for them. You know, there's Replit that's also creating a ton of websites for people, Lovable, etc. So I'm kind of curious, like, doesn't every individual with their own little website need to be freaking out, or can they trust the the businesses that, you know, help them build their websites?
00:23:46 · Tomer Schwartz, Rebecca Balan
[00:23:46] S2: So I think those major companies are well aware of this, and they have different ways to to identify if their customers are using PHP right now. So I've seen a lot of notifications on this. I think that those centralized businesses are are taking this very very responsibly and are trying to be proactive about this. In many cases, they can patch behind the scenes. If they can't, they do notify their customers to to let them know. But I do encourage you to to think about all of those smaller businesses that maybe have set up a WordPress site sometime in the past and maybe have not used those more centralized platforms, I think these are are very likely to be vulnerable. The other thing is that if you're not sure, just ask. Uh-huh. So you can contact the the platform that you're using. You can even contact us at php two shell dot com. We're trying to to have a very clear advisory there with all of the details, all of the technical details. And if something is not covered there, there's also a way to contact us to to see if we can help. [00:24:49] S1: Okay. So since this is going to be a continuous issue, unfortunately, this kind of crisis level vulnerabilities that are going to be found, or at least that's what we think is going to happen, what's your advice for companies out there with 10 people and no security team? What do they even do this week or this quarter?
00:25:08 · Tomer Schwartz, Rebecca Balan
[00:25:08] S2: It's a good question, because we got to prepare to a time in which critical vulnerabilities are discovered all the time. So for new startup companies, for new businesses, I do encourage everyone to think about how the architecture can be as resilient as possible to changes. So if right now we're thinking about businesses that were built pre AI and maybe they have some some manual patching cycles, I think these will never scale given the the amount of vulnerabilities that is upon us. Right? So if we're seeing similar vulnerabilities disclosed on a monthly basis or even on a weekly basis, you got to really think about your patching strategy and your, honestly, your your whole IT architecture from first principles and think about if we can take down systems, if we can automatically patch, if everything is defined in code in a way that allows us to spin up the continuous deployment cycle change things behind the scenes. I think these are very good practices to think about, especially when you're still small. It's much harder to make these changes if you're a thousand people company already with a ton of legacy systems. So I think those smaller companies that are now emerging are actually in a pretty good spot. But you're going to think about this and not just hope that these things will not happen. [00:26:36] S1: Yeah. Would you say that for startups, like early stage startups, are we at the point where one of your first hires or even one of your cofounders should be a security person?
00:26:36 · Rebecca Balan, Tomer Schwartz
[00:26:36] S1: Yeah. Would you say that for startups, like early stage startups, are we at the point where one of your first hires or even one of your cofounders should be a security person? [00:26:47] S2: Well, it's hard for me to say because I am. But I think it depends on the business. Right? I think there's there's some businesses where it makes sense. If a big part of the way that you're doing business relies on trust, I think it makes more and more sense to have that expertise in house. If it's not a founder, maybe it's one of the very first hires that you're making to make sure that you're actually building this in the right way. Otherwise, this will always be something that will stop you from being able to accelerate and move faster and faster as a company. So if you're not really thinking about this from the get go and let's say that you're dealing with, you know, critical personal data and this really is the foundation of your business, you've got to think about this from the very, very early days. Otherwise, again, you'll be in a situation that you're just... Every single week is going be a fire drill and it's going to be very difficult for you to scale. [00:27:46] S1: And Tomer, you haven't only been with Wiz, right? You had your own two startups, right? Both were cybersecurity startups. It might be, you know, give us a little walkthrough of what those companies were, how they exited and what advice you might have for what I'm sure is a plethora of cybersecurity startups that are coming onto the scene today.