Property AI Report
00:16:16 · Mal McCallion
[00:16:16] S0: So yeah, I'd like you, I'm kind of thinking that the actual staff costs, you know, of actually chasing all this stuff is huge. Um, the you know, the full th the increased fall through is because over time, inevitably more fall through the longer it goes on. So if you constantly are up, then you know less fall through. So yeah, I'd I'd probably think they could have been a little bit more aggressive in terms of what those savings were, but uh, but yes, we shall see whether whether and when these alleged savings actually arrive. All right, that is our uh properties this week. Um let us move on to our 100th AI and tech news. All right, there's only really one story in AI tech news, although we will do two others, and that's about Black October, as we are now calling it. This is when essentially last week, PHP, which is a programming language, um, a kind of catastrophic flaw was found by AI in everything that's got PHP associated with it, which is something like 70% of um of the entire internet is is built on, or at least has a piece of this um this particular coding in it. So it started to kind of ripple, didn't it? Sort of on Tuesday. I started to see some sites go down and Google Cloud went down, and then all the way through Wednesday and Thursday, various others. Matt, from your um vast knowledge, what's what's been happening here? Um yeah, what's uh what's gonna happen?
00:17:28 · Matt Goddard
[00:17:28] S1: I think the first point is actually Google Cloud was separate to PHP going down. Just as you say, the PHP is sort of the backbone of the internet in a way, it's been around since the 90s, and 70% of um of the internet does does have some form of PHP in. It's an interesting one because when it started to hit, I was actually in a website company's offices, and it wasn't so much at their issue because uh anyone who knows websites and WordPress is is fundamentally based on top of PHP, and and this company uses WordPress in some ways, but it was actually it was more interesting to see the companies that didn't start notifying people to say there was an issue because you start thinking, well, hold on, so question mark we touched on before, you know, you've had emails from RedBit saying, look, you you need to notify us if you've got this in your stack. Like people have been very, very proactive, and and actually I've been more thinking about the companies who haven't been in touch to say, you know, we've got an issue, especially when I know that they've got PHP in the background. It's like, well, why haven't you notified us? One one particular company came back and went, Oh, we knew within an hour fixed it, we didn't need to tell you. And it's like that's uh it's an interesting approach to cybersecurity. Right. Yeah. But uh, this is actually it was found about two months ago. Um, in the background, and I I sort of maybe misrepresented it on LinkedIn in the post because I said, you know, part of mythos was all these zero-day vulnerabilities being discovered. There's one guy actually claiming this PHP 2 shell, which is the the sort of the brief name for it. He discovered it by saying into um uh ChatGPT 5.6 Sol, find me some sort of vulnerabilities in in PHP. And apparently it went off and found them. But it was found two months ago by someone at OpenAI, sort of alerted all the authorities, and as part of that sort of glass wing collection of businesses, they all started working together. Um, and over the last two months they've notified companies like Cloudflare, who've got sort of a third of the internet, so they could proactively start trying to block any malicious and bad actors as and when this sort of news broke.
00:19:23 · Matt Goddard
But I guess what's interesting is like given it was discovered two months ago, given the number of companies involved trying to shut all of this down before they sort of announced the patch, because um obviously if PHP the business and and sort of the people fix the protocol and put that out in their release notes that there's a patch to fix a vulnerability, suddenly everyone spots it and they'll start they'll start working on it. And I was I was listening to a podcast with Matthew Prince, who's the CEO of Cloudflare, who support about a third of the internet, and he was saying that in the build-up they'd had maybe thousands of attacks on their their sort of their clients' data and people trying to use this. And as soon as the patch was released, it was tens of millions a minute of um people trying to exploit the vulnerability. And I think to summarize what can happen without having credentials or keys or or any of the normal sort of things you put in place for security, people for using this vulnerability could start running code on your server, just like literally walking through the front door and start maliciously acting. And um, obviously that's extremely dangerous. I know you you had to start um working, didn't you? Because some of the the platforms you rely on were exposed with this vulnerability as well.
00:20:31 · Mal McCallion
[00:20:31] S0: Yeah, it's exactly that. So there's kind of two layers, right? That there's you, so you know we've got absolutely no PSP in it, we're all fine, absolutely rock solid. But we use um certain price suppliers, as pretty much everybody else does. And one of them in particular a company called Railway, they that that went down very quickly. So they took it down very quickly, and then they kind of slowly put it back up again. So what that meant was we weren't able to update certain bits and pieces, but it was all business as usual and all fine. And what we found then the next day was that actually what happened with Railways, it got attacked, it got broken into, and and essentially all of the API keys for various um like like Chat GPT and uh other APIs that we run, those keys got exposed. So people were able to use those keys to run their own stuff. So what we found the next day was that um $266 of our Chat GPT OpenAI account had been used to help somebody to build a wizard game called Golem. All right, and that that was obviously what what OpenAI was able to tell us. Now, luckily, we did not have auto um auto refill on the account, otherwise, they could potentially have taken much more. But I think you know, to your point and also to reflect on the Google Cloud, as you say, that incident last week, which were separate. This is a time where things are going to go quite weird. Cybersecurity is going to be huge, and we are all gonna have to be a lot quicker and a lot better at understanding what's in our stacks, what we actually rely on, and which particular vendors, as you say, Matt, are very open about when things go wrong versus which ones just kind of hand wave it away. Hope nobody notices because it is um yeah, where you have um really where you rely heavily on different parts of your business, now is probably a good time to actually really review everything and every company that you are using because over the next month, three months, six months, year is probably going to be the max in terms of danger because we haven't.
00:22:23 · Matt Goddard, Mal McCallion
[00:22:23] S1: I reckon. [00:22:23] S0: You reckon, yeah, yeah. Because we we haven't got the we we we we don't know how to deal with this well enough yet, and but the knowledge is coming thick and fast from AI. So, yeah, uh yeah, Matt, in terms of what what you'd sort of um uh recommend for people, what's um what should people out there be doing?
00:22:37 · Matt Goddard
[00:22:37] S1: I d I think before we move on to that actually, because it's and then and just to put the like a couple of years, I think this was such a standout because of it's the first one we've really had since all of this came along, right? And just the sheer impact it had on on the internet companies. You know, street took itself offline, Alto wasn't accessible, you know, all these CRMs that sort of unpin our our industry suddenly disappeared, and people are apparently putting on Facebook groups, you know, I'm having to use paper and pen and they're going back. And it's always worth having that sort of disaster recovery scenario, right? It's not disaster recovery, sorry, like high availability of what do you do in the scenarios where you can't go through, you know, if you've got access to your diary offline and if you'd be able to you know continue progressing things. But it was more a case of at the same time this PHP one was hitting, and I was on the train back from Manchester thinking, fortunately, I don't have an HP in any of the stuff that we've built. I was uh sort of emailing devs, um, and then there was an issue with Node.js, which we do use, which is another technology that powers millions of web applications. Um, and it's like one of those things where it took me back actually, and hopefully you won't mind me saying this was years ago when when we were sort of in uh RePIT, like 2015, 2016. I remember Jupyts went down for about five days, and no one could access Dupex, which is like the sort of uh it's a part of Alto group now, isn't it? Web-based CRM and it was down. And Whaley, Sam and Whale, who was our sales director, was like, this is brilliant, and I was like, Don't tweet anything about it, you know, glass houses, it could easily be be us tomorrow because you just like don't literally don't know what's going to be, and you can do all the prep and everything else. Just as I was thinking that on the train to Manchester, there's a Node.js issue sort of highlighted a vulnerability. And I think it's really important to highlight that these vulnerabilities don't mean there's been breaches, it doesn't mean there's been significant issues and your data's been lost. It means that they've been brought to our attention and we need to act fast to close them down.