00:00:02 · John Coogan, Jordi Hays, Matthew Prince, MC Lader
[00:00:02] S0: You're watching TVPN. Today is Thursday, 10/22/2026. We are live from the TVPN Ultra on the Temple Of Technology, the Fortress Of Finance, the capital of capital. Let me tell you about ramp.com. Time is money. Save both. Easy use corporate cards. Go pay accounting and a whole lot more all in one place. We have Matthew Prince already with us, the CEO, cofounder of Cloudflare, here to break down p two p two shell, PHP two shell. I'm I'm rusty. I wasn't here yesterday. I'm back today, but we're very excited to be joined by Matthew Prince. Let's bring [00:00:33] S1: him Sick day. Whatever that means. Here he is. [00:00:37] S0: Yes. I was out yesterday. I'm a little rusty. Thank you so much for taking the time, Matthew. How are you doing? [00:00:42] S2: I'm I'm good. I'm... I mean, it's been a it's been a busy [00:00:46] S0: Yeah. [00:00:46] S2: Been a busy week and and and especially busy morning getting getting the news [00:00:50] S3: I'm sure. [00:00:50] S2: Of this out, but really proud of the team at Cloudflare and what we're doing to help help make sure that the Internet stays safe. [00:00:56] S0: Yeah. What actually... What what is the timeline here? What happened? When did this start in your world? Because I think a lot of people found out about it from your post yesterday or from, a number of other posts that went out just yesterday, but, it seems like your team is not asleep at the wheel. You've known that this is gonna be the year of cybersecurity risk. You've been doing a lot of things. So take us through your timeline of what
00:00:56 · John Coogan, Jordi Hays, Matthew Prince
[00:00:56] S0: Yeah. What actually... What what is the timeline here? What happened? When did this start in your world? Because I think a lot of people found out about it from your post yesterday or from, a number of other posts that went out just yesterday, but, it seems like your team is not asleep at the wheel. You've known that this is gonna be the year of cybersecurity risk. You've been doing a lot of things. So take us through your timeline of what [00:01:16] S1: Wearing my tinfoil hat. You guys were having some big party yesterday. We were having we were having... [00:01:21] S2: We had our we had our customer conference as well. So so it was it was... Customer conference. [00:01:27] S0: All I saw Sounds like a victory last to me. There [00:01:30] S2: you go. We we had a we had a good time. Yeah. But... So so we were about two months ago [00:01:36] S0: Okay.
00:01:37 · Matthew Prince
[00:01:37] S2: OpenAI originally reached out to us to let us know that they, in combination using their models but also some of the work that some security researchers had done Yeah. Had found a vulnerability in a piece of software called PHP. PHP is a programming language for the web. It's a very popular programming language. About 70% of the web uses it. Popular CMS services like WordPress are built on top of PHP. And the problem with this vulnerability is it was called an RCE or remote code execution vulnerability. And what that means is that you can send some basic just requests to a server and then essentially take that server over, be able to run your own code on that server. So you could read all the files on the server. You could spy on anything. If someone was typing in usernames and passwords on a website and you'd taken over the server, you'd be able to see those usernames and passwords. You could take it over to do other criminal things like make it part of a botnet, launch denial of service attacks, distribute child pornography. And so the ability to take over a server is extremely bad. And this vulnerability allowed that to happen. Not that long afterwards, Wizz, which is a subsidiary of Google, also discovered a second vulnerability in PHP, which they also disclosed to us. And I think in this case, Google's team and OpenAI's team did exactly the right thing. They quietly worked with industry leaders like Cloudflare to say, hey, we found this problem. How can we clean it up? And it wasn't just They went to Automatic which is the creator of WordPress. They went to the PHP Foundation which maintains PHP. They reported it to the United States government. And over the last two months, there's been a concerted effort by lots of organizations to say how can we get in front of this particular risk. And so at Cloudflare, we implemented for all of our customers for free, quietly behind the scenes without really letting anyone know a level of protection. And that was true for even our free customers because we think it's important to make sure that the internet stays safe no matter what that help protect against that. And that's effectively like a band aid. You know, if you break a bone, you want to actually get the bone fixed. But in the meantime, you might put a sort of a bandage on it. Clefler provided that bandage to help buy some time.
00:03:55 · Matthew Prince, Jordi Hays
But anyone that's running a web server today, you know, the the... You you need to be up... If it's running PHP, you need to be up... Updating that. It's it's critically important. The NSA has issued guidance that if for some reason you can't issue the patch, it's actually better to take your server offline than it is to to run it naked right now. And we we went from seeing, you know, before, you know, or... It's clear that some details of the of the vulnerability got leaked, which if you're reporting to that many people, fact that that was kept secret for as long as it [00:04:29] S1: was. Yeah. I was gonna say, that is that somewhat... Yeah. Isn't that somewhat of a miracle that this has been going on for two months and it required coordination between people and tons of different country... Countries and different organizations. Like, honestly, some... You know, restore some faith in humanity that people could keep that big of a secret that
00:04:29 · Jordi Hays, Matthew Prince
[00:04:29] S1: was. Yeah. I was gonna say, that is that somewhat... Yeah. Isn't that somewhat of a miracle that this has been going on for two months and it required coordination between people and tons of different country... Countries and different organizations. Like, honestly, some... You know, restore some faith in humanity that people could keep that big of a secret that [00:04:49] S2: And it was... And I I think they did. It was it was just in the last, you know, thirty six hours that we started to see an uptick where clearly something had leaked. Interesting. And and that then prompted the PHP Foundation to release the patch. The problem is the minute you release the patch, it gives enough detail that... And people can figure out how the exploit happens. So we went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute Wow. Across our network where there... You know, people are trying to compromise servers. And again, you know, Cloudflare's protection is helping. But the real key is if you're running a server right now, get it updated with with the latest version of PHP. It's free. It should only take a few minutes to do it. Sure. If you're if you're using managed software like like WordPress, often it will do it for you automatically. But that's that's the most important thing that you can do to stay safe right now.
00:04:49 · Matthew Prince, John Coogan
[00:04:49] S2: And it was... And I I think they did. It was it was just in the last, you know, thirty six hours that we started to see an uptick where clearly something had leaked. Interesting. And and that then prompted the PHP Foundation to release the patch. The problem is the minute you release the patch, it gives enough detail that... And people can figure out how the exploit happens. So we went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute Wow. Across our network where there... You know, people are trying to compromise servers. And again, you know, Cloudflare's protection is helping. But the real key is if you're running a server right now, get it updated with with the latest version of PHP. It's free. It should only take a few minutes to do it. Sure. If you're if you're using managed software like like WordPress, often it will do it for you automatically. But that's that's the most important thing that you can do to stay safe right now. [00:05:46] S0: What about in the in the consumer realm? Are there... I've I've been sort of... You know, I've I've run into other people who have been like, oh, I've heard about this. Do I need to update my iPhone or update my Chrome tabs? Like, is there anything that that that breaks out into the consumer world, or is all of this just for, webmasters, people who are actually serving, web services, running servers, or does anything bleed over into consumer just yet?