When the Internet's Plumbing Bursts | 2 Minute Drill with Drex DeFord

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

When the Internet's Plumbing Bursts | 2 Minute Drill with Drex DeFord

[00:00:00] Drex: Hey everyone, I'm Drex, and this is the Two Minute Drill. Thanks to SureTest for sponsoring today's show. It's great to see everyone today. Here's some stuff you might want to know about. There's a piece of software that you've probably never thought about, and it turned out to be a pretty big deal last week. It doesn't have a logo that you'd recognize. It's not from a company that you know. There's no big company behind it. The software is called PHP. PHP was born in the mid-1990s. One guy wrote it to keep track of who was visiting his personal webpage. And 30 years later, it runs roughly 70% of all the websites that you visit. WordPress runs on it, online stores run on it, a lot of login pages for everything on the internet uses it. Even your hospital's website, decent chance it runs PHP too. PHP is the plumbing, and you only think about the plumbing when the pipes burst and the basement floods. Well, last Tuesday, the basement started flooding. Somebody posted on a public forum that two critical flaws in PHP would be announced the following Thursday. And those details, all of that was supposed to stay secret until the fix was ready. But those secrets didn't stay secret. And so now the clock was running. The flaw lives in PHP's core. It's buried, it's in the plumbing. Nobody thinks about it. So for example, a clean, fully updated WordPress site running on a vulnerable version of PHP is still exposed. An attacker could run their own commands on the servers and without logging in, read whatever was sitting in its memory. Passwords, session tokens, the keys to, that the server uses to talk to other systems. PHP rushed the fixes out on Wednesday morning, a day early. The NSA told organizations to patch right away or take their PHP systems offline. Europe's cyber response team said the same thing. The strangest part of the story though, is how those vulnerabilities were found. According to one account, versions of this flaw had been spotted before, reported in 2020, bumped into again in 2024 during an audit. But the auditors couldn't prove it was dangerous because it turned out that turning this into a working attack, a working exploit, meant chaining together a long stack of tiny finicky steps with a world-class team of hackers. Even then, it would have taken them months to put it all together. So the auditors and everyone else involved just didn't see how or why anyone would spend that much time figuring out how to weaponize this flaw. But now, AI researchers pointed an AI at it and the AI did all the grinding, try, fail, adjust, try, again, again, a thousand times. And with AI, one researcher reportedly built a working exploit in about a week. So a bug that originally wasn't worth anyone's time became super hot overnight, the must patch of the day. And PHP wasn't the only thing that broke last week. Another popular tool called LiteLLM shipped poisoned versions of itself that stole passwords and cloud keys. And an Indian company that issues the digital certificates that websites use to prove they are who they say they are said its private keys were compromised. And Node.js, another quiet piece of internet plumbing, had to patch a serious flaw that attackers were using to open cybersecurity doors. Lots of old, invisible parts, all in the same 48 hours. They, overnight, became really important. Now, it turns out your health system runs on plumbing exactly like this. The public websites, the patient portal, some vendor built 10 years ago, the intranet, the scheduling pages, the little app your foundation uses for donations, your network infrastructure, all those things you keep putting off replacing, all of it, all there until the pipes burst. One more number, an internet scan found that PHP servers that report their version of those, 59% of those servers are running PHP 8.1 or older, and those versions are retired. There's no fix probably coming for those. That flaw will continue to be available to cybercriminals who find those servers. Think about it this way, too. Every patch is also a map. It shows defenders where to fix, but it also shows attackers where to look and where to attack. And now AI can read that map faster than most of us can schedule the change control meeting to talk about installing the patch. So here's today's questions. How many systems in your organization run PHP and who owns each one? And how many of them are on versions that will never get another fix? And this isn't just really a PHP question. Think about it. Think about this in the context of all the old hardware and software that you might be running in your environment, old, unpatchable, invisible plumbing that's kind of held together by electronic duct tape. And when the next bad day hits, can you patch in hours or minutes? Or does that take a committee? That's it for today's two-minute drill. Thanks again to SureTest for sponsoring today's podcast. Drop me a note. Let me know what you're working on. I'm always happy to hear from you. I'm Drex at 229project.com. Thanks for being here. Stay a little paranoid. And I'll see you around campus.