00:01:37 · Matthew Prince
[00:01:37] S2: OpenAI originally reached out to us to let us know that they, in combination using their models but also some of the work that some security researchers had done Yeah. Had found a vulnerability in a piece of software called PHP. PHP is a programming language for the web. It's a very popular programming language. About 70% of the web uses it. Popular CMS services like WordPress are built on top of PHP. And the problem with this vulnerability is it was called an RCE or remote code execution vulnerability. And what that means is that you can send some basic just requests to a server and then essentially take that server over, be able to run your own code on that server. So you could read all the files on the server. You could spy on anything. If someone was typing in usernames and passwords on a website and you'd taken over the server, you'd be able to see those usernames and passwords. You could take it over to do other criminal things like make it part of a botnet, launch denial of service attacks, distribute child pornography. And so the ability to take over a server is extremely bad. And this vulnerability allowed that to happen. Not that long afterwards, Wizz, which is a subsidiary of Google, also discovered a second vulnerability in PHP, which they also disclosed to us. And I think in this case, Google's team and OpenAI's team did exactly the right thing. They quietly worked with industry leaders like Cloudflare to say, hey, we found this problem. How can we clean it up? And it wasn't just They went to Automatic which is the creator of WordPress. They went to the PHP Foundation which maintains PHP. They reported it to the United States government. And over the last two months, there's been a concerted effort by lots of organizations to say how can we get in front of this particular risk. And so at Cloudflare, we implemented for all of our customers for free, quietly behind the scenes without really letting anyone know a level of protection. And that was true for even our free customers because we think it's important to make sure that the internet stays safe no matter what that help protect against that. And that's effectively like a band aid. You know, if you break a bone, you want to actually get the bone fixed. But in the meantime, you might put a sort of a bandage on it. Clefler provided that bandage to help buy some time.
00:03:55 · Matthew Prince, Jordi Hays
But anyone that's running a web server today, you know, the the... You you need to be up... If it's running PHP, you need to be up... Updating that. It's it's critically important. The NSA has issued guidance that if for some reason you can't issue the patch, it's actually better to take your server offline than it is to to run it naked right now. And we we went from seeing, you know, before, you know, or... It's clear that some details of the of the vulnerability got leaked, which if you're reporting to that many people, fact that that was kept secret for as long as it [00:04:29] S1: was. Yeah. I was gonna say, that is that somewhat... Yeah. Isn't that somewhat of a miracle that this has been going on for two months and it required coordination between people and tons of different country... Countries and different organizations. Like, honestly, some... You know, restore some faith in humanity that people could keep that big of a secret that
00:04:29 · Jordi Hays, Matthew Prince
[00:04:29] S1: was. Yeah. I was gonna say, that is that somewhat... Yeah. Isn't that somewhat of a miracle that this has been going on for two months and it required coordination between people and tons of different country... Countries and different organizations. Like, honestly, some... You know, restore some faith in humanity that people could keep that big of a secret that [00:04:49] S2: And it was... And I I think they did. It was it was just in the last, you know, thirty six hours that we started to see an uptick where clearly something had leaked. Interesting. And and that then prompted the PHP Foundation to release the patch. The problem is the minute you release the patch, it gives enough detail that... And people can figure out how the exploit happens. So we went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute Wow. Across our network where there... You know, people are trying to compromise servers. And again, you know, Cloudflare's protection is helping. But the real key is if you're running a server right now, get it updated with with the latest version of PHP. It's free. It should only take a few minutes to do it. Sure. If you're if you're using managed software like like WordPress, often it will do it for you automatically. But that's that's the most important thing that you can do to stay safe right now.
00:04:49 · Matthew Prince, John Coogan
[00:04:49] S2: And it was... And I I think they did. It was it was just in the last, you know, thirty six hours that we started to see an uptick where clearly something had leaked. Interesting. And and that then prompted the PHP Foundation to release the patch. The problem is the minute you release the patch, it gives enough detail that... And people can figure out how the exploit happens. So we went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute Wow. Across our network where there... You know, people are trying to compromise servers. And again, you know, Cloudflare's protection is helping. But the real key is if you're running a server right now, get it updated with with the latest version of PHP. It's free. It should only take a few minutes to do it. Sure. If you're if you're using managed software like like WordPress, often it will do it for you automatically. But that's that's the most important thing that you can do to stay safe right now. [00:05:46] S0: What about in the in the consumer realm? Are there... I've I've been sort of... You know, I've I've run into other people who have been like, oh, I've heard about this. Do I need to update my iPhone or update my Chrome tabs? Like, is there anything that that that breaks out into the consumer world, or is all of this just for, webmasters, people who are actually serving, web services, running servers, or does anything bleed over into consumer just yet?
00:05:46 · John Coogan, Jordi Hays, Matthew Prince
[00:05:46] S0: What about in the in the consumer realm? Are there... I've I've been sort of... You know, I've I've run into other people who have been like, oh, I've heard about this. Do I need to update my iPhone or update my Chrome tabs? Like, is there anything that that that breaks out into the consumer world, or is all of this just for, webmasters, people who are actually serving, web services, running servers, or does anything bleed over into consumer just yet? [00:06:14] S1: People are saying cycle your your Social Security number. [00:06:18] S0: Oh, yeah. Rotate your Social Security number. I saw that. [00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers
00:06:21 · Matthew Prince, John Coogan, Jordi Hays
[00:06:21] S2: Yeah. I think... I mean, I I think that in this particular case, you know, the PHP vulnerability Yeah. Really applies to businesses and people running running web servers. So there's not as much for the consumer. But but, you know, it would... As as if TSTO and the Chainsmokers and Common and a... And one of the worst vulnerabilities the web has ever seen wasn't enough for one week. We also had other vulnerabilities that were disclosed this week. There was a Node. Js vulnerability that was also something that probably consumers have to care about. The one that consumers should care about more is that there was a... It was discovered that one of the key root servers that powers the encryption behind the Internet, they're supposed to be secured with these very long complicated passphrases. They're supposed to be three twenty eight bits at a minimum. Instead, an an Indian company that was running some of these these root root server... Root key servers [00:07:16] S0: Yeah. [00:07:16] S2: They... Instead of using 328 bits, they used literally the number four. [00:07:21] S0: Yeah. [00:07:21] S2: So their password was less secure than your ATM PIN. Yeah. And the problem with that is that because... Can we give them [00:07:28] S1: the the benefit of some four d chess? Because... [00:07:31] S0: Who would think to guess that? [00:07:32] S1: No one... No one's thinking if you were gonna try to brute force it, you would pick a number at least in the four digits Yeah. And then go from there.