สำเนาบทสนทนา 🔗
WEBVTT
00:00:00.719 --> 00:00:02.959
Hello everyone, welcome to Cyber Leaders.
00:00:03.040 --> 00:00:04.240
I'm James Lyne.
00:00:04.480 --> 00:00:07.839
And I'm Kieran Martin, and it's another special episode, James.
00:00:07.919 --> 00:00:14.000
This one, it's in commemoration of we've suddenly noticed it's Cybersecurity Awareness Month.
00:00:14.080 --> 00:00:15.919
How's that going for you this year, James?
00:00:16.320 --> 00:00:21.679
I am feeling much more aware of Cyber than I think I ever have felt, Kieran, actually.
00:00:22.079 --> 00:00:26.000
I mean, it's been a roaring success, Cybersecurity Awareness Month this year, certainly for me.
00:00:26.079 --> 00:00:28.640
It's been much better than Sober October, that's for sure.
00:00:29.120 --> 00:00:37.039
Now look, um uh joking aside, or joking paused, more accurately, um, there's quite a lot going on.
00:00:37.679 --> 00:00:41.039
And uh cybersecurity is leading the global news.
00:00:41.200 --> 00:00:46.000
There's this PHP vulnerability, but there's lots of other things too.
00:00:46.159 --> 00:00:50.399
Why don't you set out for us just the full panopoly of what's going on?
00:00:50.560 --> 00:00:59.600
And then we'll look at PHP and maybe one other aspect of what's going on and try and give real, usable lessons for the cyber leadership community.
00:00:59.759 --> 00:01:00.320
So over to you.
00:01:00.399 --> 00:01:01.439
What's going on, James?
00:01:01.840 --> 00:01:03.119
What's the saying, Kieran?
00:01:03.280 --> 00:01:08.719
Um, nothing then uh nothing then all at once does seem to somewhat uh apply to this week.
00:01:08.959 --> 00:01:20.400
Yeah, look, I mean, the headlines are on fire in particular with these PHP flaws, two two very nasty remote code execution bugs that I know we'll dive into more.
00:01:20.560 --> 00:01:29.680
Yeah but what I think is particularly interesting as you've noticed, there's also flaws in bind that you know runs the infrastructure more broadly, DNS.
00:01:29.760 --> 00:01:40.799
There's flaws in Python, in Node.js, um, some fascinating issues going on in the global kind of certification and crypto infrastructure, particularly in India.
00:01:41.040 --> 00:01:49.280
So it it just it just seems like simultaneously, all at once, everywhere across the globe decided to have some form of serious flaw.
00:01:49.599 --> 00:01:57.200
So let me push you on this in terms of its consequences and also what it means strategically, because you know, like a lot of people, I'm waking up.
00:01:57.280 --> 00:01:59.519
I'm probably doing that stupid thing when you first wake up.
00:01:59.599 --> 00:02:00.799
I'm looking at social media.
00:02:01.040 --> 00:02:01.680
Very dangerous.
00:02:01.920 --> 00:02:03.599
Some people are sane, but I'm not.
00:02:03.840 --> 00:02:09.280
So we we look at social media and we look at the cyber subsection of social media.
00:02:09.360 --> 00:02:15.520
And right now, there's a lot of people, particularly in the United States, but not confined to the US, who are saying, this is it.
00:02:15.759 --> 00:02:24.080
So insert the prefix, whether it's breach, vuln, cyber, whatever, but then use the suffix is pocalypse and it's beginning.
00:02:24.159 --> 00:02:24.800
This is the moment.
00:02:24.879 --> 00:02:26.319
We've been warning about it for ages.
00:02:26.400 --> 00:02:28.080
But look, and they and they do your list.
00:02:28.159 --> 00:02:34.479
They do PHP, they do the India crypto thing that will come through, they do all sorts of other things, buying that you mentioned, and they say right.
00:02:34.639 --> 00:02:42.000
And some of them, and I've seen at least two viral essays on on this, are literally saying it's time to switch everything off and head for the hills.
00:02:42.159 --> 00:02:45.599
It's time to stockpile cash, it's time to stockpile water.
00:02:45.680 --> 00:02:52.319
Even our own government here in the UK, although it's not specifically about cyber, it's a sort of unhappy coincidence that they're talking about wider things.
00:02:52.479 --> 00:02:59.199
But there people are getting serious advice that the digital age is now fraught with immediate life-threatening peril.
00:02:59.439 --> 00:03:04.240
Um, you have a long perspective and a deep technical understanding of this.
00:03:04.560 --> 00:03:09.599
Is it just a set of unhappy coincidences in the same week?
00:03:09.919 --> 00:03:18.080
Is it a huge structural shift for the worst that's going to speed up and we're going to have every week like this in 2027?
00:03:18.159 --> 00:03:19.199
Or is it somewhere in between?
00:03:19.280 --> 00:03:21.360
What's going on strategically, James?
00:03:21.759 --> 00:03:22.719
Yeah, good question.
00:03:23.199 --> 00:03:33.280
Look, I I um I do not love this fear-mongering that one must accumulate cans of spam in response to the impending Volume apocalypse.
00:03:33.599 --> 00:03:36.479
It's spam, but not as we know it in cybersecurity.
00:03:36.719 --> 00:03:39.520
It's an unfortunate food choice on my part there.
00:03:40.000 --> 00:03:46.960
Yeah, look, I I do think that um, you know, it is wrong to sit at either extreme on this.
00:03:47.039 --> 00:03:56.400
To say that the likes of AI is having no impact on the work in cybersecurity, the opportunity for attackers, the pace, I think is wrong.
00:03:56.560 --> 00:04:06.800
To flip to this other extreme that every week will now be like this and that technology can no longer be trusted, I think is entirely disproportionate.
00:04:06.960 --> 00:04:23.120
Um, and perhaps, Kieran, in support of that, before we get into these kind of AI-assisted flaws that have been found in PHP, let's actually pick another example that's really serious, precisely because it has basically nothing to do with AI and these claims.
00:04:23.439 --> 00:04:23.600
Okay.
00:04:23.680 --> 00:04:25.839
I think you're going to India, aren't you, James?
00:04:26.079 --> 00:04:26.800
I am.
00:04:26.959 --> 00:04:34.879
Yeah, look, amid all
Load full transcript
this sophistication comes a reminder that sometimes the problems are rather simpler.
00:04:35.519 --> 00:04:43.759
So for those of you that you know haven't read up on this one for all the other great distractions this week, e-Mudra, they're an Indian certificate authority.
00:04:43.920 --> 00:04:48.959
Um, and in fact, the only Indian route certificate authority trusted globally.
00:04:49.600 --> 00:05:00.079
And these guys issued it kind of eight intermediate certificates whose private keys were so small you could guess them.
00:05:00.560 --> 00:05:05.199
And you might be thinking, oh, okay, you could guess them with you know mass computational power.
00:05:05.279 --> 00:05:09.120
And uh no, one of the numbers was four.
00:05:10.079 --> 00:05:13.839
Not four bits, mind you, actually four.
00:05:14.560 --> 00:05:20.160
Um I think you refer to EMUDR as India's formerly only trusted certificate authority.
00:05:20.319 --> 00:05:30.000
And what I do love about this is we're long used to, particularly in this part of the world, to Douglas Adams telling us that you know the key to the secrets of Earth and the secrets of human life is 42.
00:05:30.240 --> 00:05:33.279
Turns out the key to the secrets of India, the most populous country in the world.
00:05:33.439 --> 00:05:34.879
The key to the secrets is four.
00:05:35.120 --> 00:05:36.240
It's even easier.
00:05:36.480 --> 00:05:36.800
Okay.
00:05:37.199 --> 00:05:41.040
Along along with 66, 155, and 237.
00:05:41.360 --> 00:05:42.879
Well, that's a bit more complicated, James.
00:05:42.959 --> 00:05:44.959
I mean, you you might need an LLM for that.
00:05:45.040 --> 00:05:45.360
Or perhaps.
00:05:45.759 --> 00:05:48.720
Oh, maybe, Karen.
00:05:48.879 --> 00:05:52.879
We'll come to that because it's amazing.
00:05:53.360 --> 00:05:54.480
Oh, it's it's stunning, right?
00:05:54.560 --> 00:06:07.839
So, I mean, uh for for those who are less au fay with you know the the kind of technical specifics of how this ought to work, a proper key of this sort should be a random number that is hundreds of digits long.
00:06:08.079 --> 00:06:08.560
Right.
00:06:08.800 --> 00:06:17.120
Um, you know, and these examples we're talking about for 42, you know, they offer a few hundred possibilities at most.
00:06:17.519 --> 00:06:28.160
Um, the infamous Scott Helm, fantastic security researcher, um, he recovered all eight from these uh public certificates in under a second.
00:06:28.720 --> 00:06:36.160
Um I dare say that you know, a toddler with a calculator was probably in with a sporting chance on this one.
00:06:36.480 --> 00:06:36.879
Excellent.
00:06:38.000 --> 00:06:41.680
Now, why this matters a little bit, and then let's come back to that AI point.
00:06:41.759 --> 00:06:53.279
Um, look, we we have a technical set of listers here, so I won't overdo this, but certificate authorities are how your browser knows that your bank's website's really your bank.
00:06:53.360 --> 00:06:53.680
Yeah.
00:06:53.839 --> 00:07:00.800
Um, and of course, you know, if you've got one of these keys, you can mint a certificate for any site that you wanted.
00:07:00.959 --> 00:07:01.279
Yeah.
00:07:01.519 --> 00:07:07.839
Um, so you could pretend to be a bank, you could launch all kinds of nasty phishing campaigns, you know, you name it.
00:07:08.079 --> 00:07:12.720
What bothers me here, Kieran, I think is pertinent to our discussion, is the visibility.
00:07:13.040 --> 00:07:13.360
Yeah, yeah.
00:07:14.160 --> 00:07:20.959
These keys sat in public certificates for over a year, there for anyone who wanted to look.
00:07:21.120 --> 00:07:35.120
I mean, there was even a warning in May 2025 when the revocation lists failed their signature checks, which is you know, about as clear a red flashing light as you can get from this type of infrastructure.
00:07:35.360 --> 00:07:39.040
But it was patched over and filed as a process error.
00:07:39.279 --> 00:07:39.680
Wow.
00:07:39.839 --> 00:07:47.439
Um, you know, and and therefore, because of that, you know, independent auditors now are none the wiser on how much of this has happened.
00:07:47.519 --> 00:07:50.879
We don't know how much it's been abused.
00:07:51.120 --> 00:07:51.519
Right.
00:07:52.000 --> 00:07:55.279
Um so you know, when someone says, you know, was anyone attacked?
00:07:55.519 --> 00:07:55.839
We don't know.
00:07:56.079 --> 00:08:00.319
It's kind of a don't know, don't think so, can't prove it.
00:08:00.639 --> 00:08:13.360
But just because we'll need to get on to PHP, just to try to summarize this, we don't know what harm there's been, but clearly most of us haven't observed any that would affect us, say, outside India.
00:08:13.439 --> 00:08:19.439
So there is probably a difference in risk, isn't there, between what the risk is within India and what the risk is out with it.
00:08:19.680 --> 00:08:21.360
So that's the first question I'd like you to deal with.
00:08:21.439 --> 00:08:25.120
And then, of course, the second one is this is on a big list of the AI apocalypse.
00:08:25.199 --> 00:08:27.920
Could you describe the AI dimension to this operation?
00:08:28.160 --> 00:08:30.000
Hint, it won't take very long.
00:08:30.800 --> 00:08:32.000
Yes, yes.
00:08:32.159 --> 00:08:38.720
Uh look, I I think if you're looking at this flaw, um, the lesson stands that the mathematics are sound, right?
00:08:38.799 --> 00:08:43.679
This isn't some hyper impressive technical flaw in the crypto.
00:08:44.159 --> 00:08:46.639
It's what is so often the case in cybersecurity.
00:08:46.799 --> 00:08:48.639
The process around it failed.
00:08:48.879 --> 00:09:05.360
And as you've highlighted, Kieran, for those fretting that every great flaw now henceforth will be some AI-wrought super exploit, this one was very serious, very dumb, and entirely human.
00:09:05.919 --> 00:09:11.759
I mean, e-mudge's statement did suggest the keys could have been cracked with an AI-assisted technique.
00:09:12.799 --> 00:09:23.600
I would
gently observe that the technique in question was counting to 237, and that I might be able to accomplish that without supercharged AI LLM models.
00:09:24.000 --> 00:09:24.240
Yeah.
00:09:24.320 --> 00:09:30.399
So the lesson being that you're supposed to have 237 digits in the key.
00:09:30.559 --> 00:09:32.320
It shouldn't be 237.
00:09:32.480 --> 00:09:33.600
That's the key mistake.
00:09:33.759 --> 00:09:35.840
Uh that's the critical uh mistake.
00:09:36.080 --> 00:09:44.960
And again, just for reassurance, there's clearly lots of mitigations and management to be done within the Indian, particularly the e-government system, for reasons that we won't go into.
00:09:45.519 --> 00:09:50.559
But for the rest of us, this is not something that we have to go and fix and so forth.
00:09:50.639 --> 00:09:57.200
It's just an alarming reminder of some of the critical um weaknesses in human practice.
00:09:57.679 --> 00:10:12.320
And Kieran, if I if I may, a reminder for all of us, amidst all these headlines um where there's a predisposition to look for the sophisticated and sexy with AI, sometimes it's just process screw-ups and nastiness and cruft.
00:10:12.399 --> 00:10:22.399
And a lot of the attacks around the world still come down to those hygiene configuration and process issues, even on the scale of global trust infrastructure.
00:10:22.799 --> 00:10:23.200
Absolutely.
00:10:23.279 --> 00:10:26.960
And onto hygiene, but onto something that people do have to fix or at least should fix.
00:10:27.039 --> 00:10:29.600
Let's talk a little bit about PHCP now.
00:10:29.759 --> 00:10:32.639
We don't want to go in because of to all of the details.
00:10:32.720 --> 00:10:38.799
As you say, it's a largely technical audience and Cybersecurity Awareness Month joking aside.
00:10:38.879 --> 00:10:40.159
Everyone will be aware of this.
00:10:40.320 --> 00:10:41.360
Uh it is Walton.
00:10:41.679 --> 00:10:45.919
And it's a great webcast if you want the technical details from Moses, Frost, and Rich Green.
00:10:46.399 --> 00:10:47.919
Where they go through the demo and explain it.
00:10:48.000 --> 00:10:49.840
So we won't do that today, as you say, Kieran.
00:10:50.000 --> 00:10:55.759
And again, there's an AI, um, there is an AI dimension to this, and we can come in, we can come onto that in a little bit.
00:10:55.840 --> 00:10:59.120
But also there are words around being used like unprecedented.
00:10:59.200 --> 00:11:01.759
And whilst there aren't many precedents for this, there are some.
00:11:01.919 --> 00:11:14.000
Uh for those who've been around for a while, we've talked about log4j, log4 shell, and you know, for some of us this feels like log4j, but the media are reporting it, or you know, it's log4j again with wall-to-wall media coverage.
00:11:14.159 --> 00:11:18.080
How does it look to you two, three days on, depending on when you start this?
00:11:18.159 --> 00:11:21.919
Because of course it was the leak of the pre-agreed vulnerability process rather
disgracefully.
00:11:22.159 --> 00:11:22.879
Where are we now?
00:11:23.360 --> 00:11:23.759
Painful.
00:11:24.000 --> 00:11:24.159
Yeah.
00:11:24.320 --> 00:11:25.360
Where are we now?
00:11:26.159 --> 00:11:29.039
Yeah, look, I mean, there's no doubt it's serious, Kira.
00:11:29.120 --> 00:11:35.519
And I don't think you and I would want to walk out of this podcast with folks rolling their eyes and saying, I'm not going to bother patching.
00:11:35.679 --> 00:11:36.000
Absolutely.
00:11:36.639 --> 00:11:42.000
Is unauthenticated remote code execution in software that's running in some bank of the web.
00:11:42.559 --> 00:11:43.039
It's bad.
00:11:43.440 --> 00:11:44.639
People should be alarmed.
00:11:44.799 --> 00:11:46.159
There's something alarmed about it.
00:11:46.399 --> 00:11:46.639
That's right.
00:11:46.720 --> 00:11:47.519
You you must take action.
00:11:47.600 --> 00:11:53.360
And in the end, Kieran, we must press ourselves to give folks two or three things they they really need to pay attention to.
00:11:53.919 --> 00:12:01.360
But um, but it is a little bit more nuanced than the headlines and kind of black October and the end of the internet.
00:12:01.600 --> 00:12:06.480
I mean, for one, Kieran, there's this line of millions of attacks.
00:12:07.519 --> 00:12:08.799
Lovely figure.
00:12:09.120 --> 00:12:16.960
But, you know, a honeypot getting hammered or attackers attempting isn't the same as winning.
00:12:17.200 --> 00:12:22.320
And it turns out that the public exploits of this are fussy, right?
00:12:22.399 --> 00:12:26.559
There's a lot of works on my machine versus someone else's.
00:12:26.639 --> 00:12:35.840
And I I loved your comparison to log for shell because that was one line of text in a username field that kicked the door open reliably.
00:12:36.480 --> 00:12:43.679
This, at least yet, you know, is a serious flaw, but it's not kicking doors down the same way.
00:12:44.240 --> 00:12:46.559
The burglars are finding a lot of stiff handles.
00:12:46.720 --> 00:12:48.080
Oh, that was a good analogy.
00:12:48.159 --> 00:12:49.279
I'm going to keep that one for the future.
00:12:49.600 --> 00:12:50.080
That is excellent.
00:12:50.159 --> 00:12:51.200
But let's dig into this a little bit.
00:12:51.279 --> 00:12:55.120
Because let's face it, James, you know, you are, at least for the most part, you're a goody, right?
00:12:55.200 --> 00:12:57.759
You try and do good, you try and build communities and so forth.
00:12:58.000 --> 00:13:09.519
But let's say, for example, I was able to harness the evil spirit of Claude that we've all been reading about, and I would be able to cast a spell on you and turn you and turn you bad, because you're a very, very capable hacker.
00:13:09.679 --> 00:13:18.159
Um, and but also, I mean, you're running a huge global cybersecurity training company, but you know, in your spare time, uh, you still have time to keep yourself technically relevant.
00:13:18.480 --> 00:13:19.360
One has fun.
00:13:19.759 --> 00:13:34.399
I know you spent quite a lot of the last couple of days, ethically, of course, because we haven't cast the evil Claude spell on you, ethically trying to see if badness worked on this, because if you went to the dark side, you could cause an awful lot of trouble.
00:13:34.639 --> 00:13:44.320
So I think it would be really interesting for our technical leadership, just to give us a sense, not so much of the details, but of your experience as a proper hacker, somebody who knows what to do with this stuff.
00:13:44.559 --> 00:13:48.799
How did you find trying to exploit safely and ethically?
00:13:49.039 --> 00:13:50.159
PHP to Shell.
00:13:50.399 --> 00:14:08.320
Yeah, it it was a really interesting experience, Kieran, because I expected with the, you know, the published details, the availability of AI, and a lot of the noise around that one might feed it into AI and ask for a nice exploit, and the work would be done.
00:14:08.399 --> 00:14:17.919
And it would lead to this kind of bloodbath scenario that you know you you might read about in the news where you get, you know, pop pop and shell on PHP.
00:14:18.000 --> 00:14:20.480
You just you press a button and it and it works.
00:14:20.799 --> 00:14:22.559
Um not so.
00:14:22.799 --> 00:14:30.480
And and interestingly, you of course, there are folks who are much more talented exploit developers again than me in the community I've been talking to, also.
00:14:30.879 --> 00:14:41.279
Um, our experience is you still need a lot of expertise in combination with AI and knowledge of the details to produce something useful.
00:14:41.360 --> 00:14:41.519
Yeah.
00:14:41.679 --> 00:14:46.399
Like there wasn't this just kind of AI automated generated hack that came out of it.
00:14:46.639 --> 00:14:58.559
It took me a few hours to get to something useful on my machine, but that doesn't immediately mean that I can go and trounce around the internet and hit other people's systems.
00:14:58.879 --> 00:15:01.840
Um, so it is it's fussy and fiddly.
00:15:02.159 --> 00:15:07.519
And I suspect in time, you know, more universal exploit versions will appear.
00:15:08.000 --> 00:15:16.960
But in this interim period, it is giving us some time to patch and it doesn't have the reliability of some of those prior exploits.
00:15:17.200 --> 00:15:18.480
This was fiddly, Kieran.
00:15:18.639 --> 00:15:30.720
So let's try and bring this together for cyberleaders, because that's a really important and for now reassuring point, but I say for now, because we do do detail, we do do nuance, we do do subtlety on this podcast.
00:15:30.799 --> 00:15:34.639
That's the whole point of the damn thing, uh, rather than just, you know, hysterics.
00:15:34.879 --> 00:15:41.600
So as I read it from the much less technical background, so somebody like you, you know, super technical, very, very expert.
00:15:41.679 --> 00:15:46.080
There are others that we've we've talked to and you've talked to, and they're all
trying to see if this works.
00:15:46.240 --> 00:15:47.440
And that's the good side of things.
00:15:47.600 --> 00:15:55.679
On the bad side of things, we know, I mean, there is, and this is where AI comes in, there is an unprecedented volume of attack, of attempted attacks.
00:15:55.919 --> 00:16:06.639
And they will range from people, as one of my friends joked to me, people typing into an LLM, you know, hack PHP, make no mistakes, and seeing how they get on, which isn't gonna work.
00:16:06.799 --> 00:16:08.480
I think you've established that beyond any doubt.
00:16:08.639 --> 00:16:08.879
Yep.
00:16:08.960 --> 00:16:09.120
No, no, no.
00:16:09.279 --> 00:16:17.519
But all the way, all the way through, and I'm serious about this, all the way through to teams of evil people, like evil versions of you, um, who are really, really good at this.
00:16:17.600 --> 00:16:22.879
And they're gonna spend all weekend trying to engineer this, trying to make it work, and they might succeed.
00:16:23.120 --> 00:16:25.679
So again, this isn't just just being reassuring.
00:16:25.759 --> 00:16:26.720
There's a big risk out there.
00:16:26.799 --> 00:16:27.679
We've had a break.
00:16:27.840 --> 00:16:32.639
We've had a lucky break in that it's not log for it's not as easily exploitable as log4 shell.
00:16:32.799 --> 00:16:38.799
So if it takes them all weekend, well, then more and more people should patch between now and the other side of the weekend, et cetera, et cetera.
00:16:38.879 --> 00:16:41.120
Is that a fair sort of summary of where we are?
00:16:41.440 --> 00:16:43.360
Yeah, I I I love that, Kieran.
00:16:43.440 --> 00:16:48.080
And I and I and I think this you you kind of you highlighted our position of nuance, right?
00:16:48.159 --> 00:16:51.039
If anyone walks out of this going, oh, okay, not that bad.
00:16:51.120 --> 00:16:52.639
Never mind, I'm not gonna do anything.
00:16:52.799 --> 00:16:53.440
We failed.
00:16:53.600 --> 00:16:54.240
Yeah, absolutely.
00:16:54.480 --> 00:17:01.440
We also don't want folks running around with their hair on fire saying AI is successfully going to break every piece of software.
00:17:01.600 --> 00:17:03.840
Oh my god, it's breaking the thing that powers the whole internet.
00:17:04.079 --> 00:17:06.559
That's gonna happen next week and the week after.
00:17:06.880 --> 00:17:19.039
This is still the domain of skilled security researchers in combination with AI being augmented, not this kind of one-button exploit.
00:17:19.279 --> 00:17:25.680
But but Kira, should should we, I guess we should try and pick three or four things um for security leaders to do right away.
00:17:26.000 --> 00:17:27.839
I've got a couple in mind, unless you want to go first.
00:17:28.079 --> 00:17:29.599
No, I mean, just a reflection more.
00:17:29.680 --> 00:17:34.880
I think, you know, AI, let's set aside the apocalypse and pea doom argument and all that nonsense.
00:17:35.039 --> 00:17:36.240
I mean, it's a tool.
00:17:36.480 --> 00:17:39.680
And uh it's it's been a complicated tool for both good and bad.
00:17:39.759 --> 00:17:41.440
It's been both hero and villain of this piece.
00:17:41.519 --> 00:17:48.400
You know, AI has part funded and assisted the research that got us to identify this 14-year-old vulnerability that was going to be found at some point.
00:17:48.559 --> 00:17:54.240
And so I think it shows us that the way AI impacts on cyber is going to be complicated.
00:17:54.319 --> 00:17:56.160
It's gonna be a mixture of good and bad.
00:17:56.319 --> 00:18:07.359
And actually, you know, to try to introduce to try to um hand over on a point of I think reasoned but cautious optimism, if we do the right thing, AI will be a net benefit in this particular case.
00:18:07.519 --> 00:18:12.960
There'll be other cases where it's a net problem, but and we're gonna be here for ages.
00:18:13.119 --> 00:18:15.839
So I just wanted to make that observation in terms of the CAM.
00:18:16.240 --> 00:18:21.920
And then I think definitely, you know, I'll just do the I'll just do the clever analytical observation.
00:18:22.000 --> 00:18:24.559
Can you do the actually useful practical advice, please?
00:18:24.880 --> 00:18:25.359
You got it.
00:18:25.440 --> 00:18:25.839
You got it.
00:18:25.920 --> 00:18:27.359
We're a wonderful team, Kieran.
00:18:27.440 --> 00:18:30.400
Um, like uh like an evil Claude, might one might say.
00:18:30.559 --> 00:18:41.119
Um yeah, look, for for the for security leaders out there, I'm sure that you and your teams are already on to, you know, the harsh realities versus the headlines, but let's just make it clear.
00:18:41.519 --> 00:18:44.640
Patch the engine, not the paintwork, right?
00:18:44.720 --> 00:18:47.039
It's not about updating WordPress.
00:18:47.200 --> 00:18:50.400
You've got to get the PHP runtime upgraded.
00:18:50.640 --> 00:18:55.519
Um, number two, you're probably getting more risk from the stuff no one owns.
00:18:55.759 --> 00:18:58.079
You probably are thinking about your website.
00:18:58.240 --> 00:19:00.160
What about all the other services?
00:19:00.319 --> 00:19:04.480
The partner portal off to a side, the thing running under someone's desk.
00:19:04.720 --> 00:19:09.920
Remember that these patches don't go all the way back through the entire history of PHP.
00:19:10.000 --> 00:19:20.160
So a PHP 7 server under someone's desk or a vendor appliance that hasn't been updated, those are the things to isolate and chase down.
00:19:20.480 --> 00:19:29.839
Um and you know, lastly, if I may, count patched hosts, not blocked attacks.
00:19:30.079 --> 00:19:30.319
Right?
00:19:30.400 --> 00:19:35.599
There's this narrative forming around a million blocked requests, look at what our WAF is doing.
00:19:36.240 --> 00:19:46.400
When you really come down to it, this is a project of hygiene where you're attempting to deploy good coverage to reduce the possibility of this exploit in the future.
00:19:46.799 --> 00:19:51.839
Don't get too
hung up on the controls in front of it or the volume story.
00:19:52.079 --> 00:20:00.799
Um, so Kieran, I mean, if you'll allow me a a little a little technical reflection like yours, but for me, this is a patch it properly week.
00:20:00.960 --> 00:20:01.119
Yeah.
00:20:01.279 --> 00:20:13.279
It it might seem like a fire alarm week, but use this window while the exploits are clunky, because they often don't stay that way, um, and get the patching done.
00:20:13.599 --> 00:20:29.200
And for the cybersecurity community, remember if we cry log for shell every time, if we do this week after week, and because it's sexy and it's got AI assistance in it, no one's gonna listen when the real ones turn up.
00:20:29.519 --> 00:20:33.359
You know, these flaws have been sat in PHP for years.
00:20:33.680 --> 00:20:36.480
AI helped find them, helped build exploits.
00:20:37.200 --> 00:20:40.640
I think, Kieran, as you said, a lot more of that is going to happen.
00:20:40.880 --> 00:20:47.119
But for us as security leaders, I've said it before and I'm gonna say it again clearly here AI is gonna change the game.
00:20:47.279 --> 00:20:49.440
It's gonna change some of the players, some of the rules.
00:20:49.599 --> 00:20:52.720
It doesn't change what winning looks like.
00:20:52.960 --> 00:20:56.480
Attackers still want your data, your money, your access.
00:20:56.799 --> 00:21:06.319
So know what matters in your organization, know what someone's gonna come for, and make sure the controls and the people guarding it are up to the job.
00:21:06.640 --> 00:21:12.640
You do that, and the next round of worst bug ever is a busy week rather than a bad one.
00:21:12.880 --> 00:21:14.160
And that's where we want to get to.
00:21:14.240 --> 00:21:29.359
So thank you for that brilliant mix of specific technical advice all the way through into how to handle the people that you need support from in your organization to go and fix this, how to pitch it properly, because this isn't the last time we're going to be here, but we can't be here every day.
00:21:29.440 --> 00:21:31.759
And we're not going to be here every day.
00:21:31.839 --> 00:21:34.079
So it's important to help work out what matters.
00:21:34.160 --> 00:21:40.079
So that brings us to the end of this special episode of the Sans Cyber Leaders podcast.
00:21:40.160 --> 00:21:43.359
We'll have a regular season back pretty shortly.
00:21:43.519 --> 00:21:46.240
We may have another special episode or two.
00:21:46.400 --> 00:21:46.880
Who knows?
00:21:46.960 --> 00:21:48.240
It kind of depends what happens.
00:21:48.400 --> 00:21:51.279
Hopefully, we're not back next week with another week like this.
00:21:51.599 --> 00:21:55.119
Probably when someone picks a private key of 42 after you suggested it, Kieran.
00:21:55.359 --> 00:21:56.400
Well, exactly.
00:21:56.640 --> 00:22:01.359
But I will make no predictions other than, as they've long said in this country, we'll meet again.
00:22:01.519 --> 00:22:06.000
Don't know where, don't know when, but I know we'll meet again some cyber day.
00:22:06.160 --> 00:22:10.640
You can leave us feedback at Sans Cyberleaders the website.
00:22:10.799 --> 00:22:14.400
You can email us at cyberleaderspodcast at sans.org.
00:22:14.480 --> 00:22:18.000
There are multiple ways, but please do give us ratings and so forth.
00:22:18.079 --> 00:22:19.039
It really helps.
00:22:19.200 --> 00:22:21.839
But for now, from me, Kieran Martin.
00:22:22.079 --> 00:22:26.720
And for me, James Lyme, it's keep cybering and goodbye.
00:22:27.359 --> 00:22:29.839
And good luck patching all the things.