00:02:59 · Tomer Schwartz
[00:02:59] S2: Well, there's a lot of stories out of those forty eight hours up to the release date. We had a very concrete plan and a concrete timeline in which we were planning to release the information about the vulnerabilities along with patches. We also coordinated with a lot of different vendors and open source projects to make sure that they have releases available at that time. But unfortunately, information about the existence of the vulnerability leaked. At that point, we had to figure out what do we do with the original timeline, given the fact that if people know roughly where it is, they can all of a sudden scale up their research, find similar vulnerabilities, spin up AI models to look for the same thing. We eventually decided to accelerate the timeline, which meant that even though the PHP team was already on top of it and and with a a wonderful journey of a couple weeks of working on on those patches and testing them, in reality, it meant is that some of the downstream projects that needed to build new releases did not have enough time to build to build them before the the new release date. So in reality, what ended up happening is that a lot of different websites, lot of different government agencies, a lot of different companies were worried that once the patches are out, adversaries can sort of reverse engineer them and and find the vulnerabilities, which actually happened. And for that period of time that they knew that some of the releases... Some of the patch releases were not yet available, they decided to to shut down those websites.
00:04:32 · Rebecca Balan
[00:04:32] S1: Yes, Gary. Okay, so the timeline here was that you guys knew about this, right? So Calif is a research firm. They found the bugs, apparently, and these were verified through an OpenAI and Wiz initiative. You guys were planning to publish something about this, correct? And you had a timeline for when you were going to send out patches or update. And then it was actually leaked on social media, which created this crazy scramble. Am I have I got this roughly right?
00:04:58 · Tomer Schwartz, Rebecca Balan
[00:04:58] S2: Yeah. So a lot of different people participated in this research, and I gotta say that all of them are absolutely brilliant for finding this. It's kind of cool to see how different companies and different groups of researchers actually find similar things in parallel. My understanding of the timeline is that Calif actually found the first CVE, reported it to OpenAI. They realized they found some very similar variants of the same bug. They reported it to PHP together. And at the same time, in parallel, we had no idea about what's happening on the other side. We were looking into PHP at the same time we reported both CVEs to the PHP team. And it was the PHP team that decided to eventually say, hey, You know, this is such a critical finding. It's gonna take us so long to actually figure out what's the best way to to fix it. Why wouldn't all of us just join the same Slack channel and start working on this together? I think it was absolutely the right choice. We managed to do amazing work together. Honestly, I was fortunate to be on literally daily calls with the PHP team, with OpenAI and Calif just working together towards the patch. [00:06:07] S1: Yeah, must have been high adrenaline times for you guys. [00:06:10] S2: It was. I just want [00:06:11] S1: to double click on something you said, that a lot of different organisations found the bug at the same time. And you're saying this is because everyone's kind of using the same AI tools to do this, to search for vulnerabilities?
00:06:11 · Rebecca Balan, Tomer Schwartz
[00:06:11] S1: to double click on something you said, that a lot of different organisations found the bug at the same time. And you're saying this is because everyone's kind of using the same AI tools to do this, to search for vulnerabilities? [00:06:25] S2: Well, can't speak for everyone, right? But what I can say is that at Wiz, what we're using is a sort of custom harness that we've built. We call this Project Atlas, which builds on top of all the frontier AI models. It leverages both the the DeepMind capability, the the OpenAI capabilities, the the Anthropic capabilities. And in reality, what it what it allows us is to scale a lot of different ideas and try different potential attack paths at the same time. So it gives us a really broad scope to be able to pull up a lot of research ideas and a lot of potential issues. And from there, what we're trying to do is to distill it down to the most impactful ones and work on them. At the same time, I do I do know a little bit from our work with OpenAI and Calif. They're doing very similar things and trying to use their own models and and and new ideas to scale up research with AI, and they're finding, in many cases, very similar bugs to to the bugs that we're seeing.
00:06:25 · Tomer Schwartz, Rebecca Balan
[00:06:25] S2: Well, can't speak for everyone, right? But what I can say is that at Wiz, what we're using is a sort of custom harness that we've built. We call this Project Atlas, which builds on top of all the frontier AI models. It leverages both the the DeepMind capability, the the OpenAI capabilities, the the Anthropic capabilities. And in reality, what it what it allows us is to scale a lot of different ideas and try different potential attack paths at the same time. So it gives us a really broad scope to be able to pull up a lot of research ideas and a lot of potential issues. And from there, what we're trying to do is to distill it down to the most impactful ones and work on them. At the same time, I do I do know a little bit from our work with OpenAI and Calif. They're doing very similar things and trying to use their own models and and and new ideas to scale up research with AI, and they're finding, in many cases, very similar bugs to to the bugs that we're seeing. [00:07:24] S1: And how much of the the bug finding is really... Is it really AI versus, you know, human work that's supercharged? Right? Like, Calif found the bugs in a security audit says... You know, this is from our our security editor, Zach. He said that AI helped with the exploitation, but there was, you know, it was 90% human work. Calif's own line on this was that no model is simply capable of unearthing all bugs, at least for now.
00:07:49 · Tomer Schwartz
[00:07:49] S2: Well, I sort of agree. There's still an art and a science to this in how do you direct all of these models and how do you actually tailor them together to to be able to find such impactful bugs. But in reality, I didn't think that we could have found it without AI. So the the opportunity for a team of 10 of the most talented people that I know that are powering the the Wiz vulnerability research team right now, if we had taken all of them and told them, hey, maybe maybe find some some PHP RCE bugs, Maybe it it would have taken them a couple months of work, maybe even twelve months of work. And eventually, who knows? Maybe maybe they would have found the same the same finding. But what's cool about this is that we managed to take all of those people and tell them, hey, why wouldn't you try 20 different ideas on various different targets and just run them on top of Atlas and find a ton of different potential vulnerabilities and maybe do it over the weekend by the time we come back next week to see everything, we had a model working for us, trying a ton of different things that maybe a human researcher would not have found up. Right? So it's kind of cool to think that right now we can get 100x, 1000x the work of a researcher, and they can actually pick and choose what are the best what are the best research ideas and what are the best solutions and where do we need to pull this thread a little more. And in in many cases, with the capability of AI models today, it might be a full exploit already available where we just need to validate and we need to understand what the vulnerability is.