S2. Ep42 - The PHP Flaw That Put Millions of Sites at Risk — What to Do Now

Katie (00:27)

Hello and welcome back to another episode. Hi, hello, I'm Katie, and as always I'm here with my co-host Noel. Hi Noel, how are you doing?

Noel (00:38)

Yeah, I'm doing wonderful this week. How are you doing?

Katie (00:41)

Yeah, good. It's going to be an interesting podcast episode. I knew we were going to be talking about this this week, because I feel like you have spoken about this a lot to me during the lunchtime kitchen chats that Noel and I have, when we both come out of our own offices and dive into the kitchen to make lunch. And Noel usually has some sort of AI chat that he's desperate to talk to me about.

Noel (01:15)

There's been lots.

Katie (01:19)

And it was a lot about this. But I guess, before we dive into this week's podcast episode subject, are there any updates that we should be aware of?

Noel (01:36)

Not overly this week, no. I had to do quite a lot of digging really to even see if there was anything about. So nothing major. Although Google Gemini announced something called Genie 4 yesterday. Essentially what it does is allow you to build 3D worlds, almost.

Katie (01:59)

Do you mean like The Sims?

Noel (02:02)

No, I mean, if you were creating a film, you could move a character around a realistic scene and stuff like that.

Katie (02:11)

Okay, so it's almost like a film set if you're doing an animation.

Noel (02:17)

Yes, kind of. So I was thinking maybe you'd use it for ads and things like that, but you have full control over where the character moves. You can use the arrow keys on your keyboard to move them around and move the camera, and it dynamically updates the video. Some of the things I've seen have been really quite cool with it, but obviously they're very much cherry picked, aren't they? It's, doesn't this look great, and then you have a go and you're like, hmm.

Noel (02:49)

It's currently on a waitlist. But I'd be excited to give that a go, because I think if you're an events organiser, or you're wanting to create ads and things like that, that could be quite a cool way of creating them. Because getting a drone and drone footage and videographers, for anyone on a budget, is...

Katie (03:11)

It's not always in everyone's budget, is it, to be able to do that? I mean, the end results are always amazing.

Noel (03:20)

Yes. So that's all I could really come up with this week. Everything else hasn't been all that great, as we'll go into in a minute.

Katie (03:30)

So let's get into the topic of this week's podcast episode. Last week there was a major security breach.

Noel (03:41)

Very major.

Katie (03:43)

So Noel, do you want to talk us through what happened?

Noel (03:47)

Yeah. So overall, it wasn't a good week for AI in general, because there wasn't just one thing, there was a multitude of things that happened last week. And I guess to go back to where it's coming from, with all of these smarter models coming out, all the frontier models are getting very, very clever at finding workarounds and hacks for different things. They've hacked into big companies and big platforms over the summer, which has all been very public. And last week we had some quite big breaches, which I think everyone who runs a business should know about, and know how to protect themselves from.

Katie (04:33)

Okay, so what exactly happened?

Noel (04:38)

So I guess the first one, the one that got the most public attention, was a bug found in a coding language called PHP. Now, I get that's probably going to be completely foreign to most people listening, but it's the code which runs seventy percent of the internet. It's been around since the late nineties, and everyone kind of thinks it's just going to die off, but actually it still runs seventy percent of the internet. WordPress is on there, and things like that.

Katie (05:13)

I was going to say, I know PHP from my WordPress website.

Noel (05:18)

Yeah, it's a nightmare, isn't it, PHP? It's one of those things.

Katie (05:23)

Well, this is why I always employed someone to help me run my website, because for me it's a bit of a minefield. Plugins, updates, all sorts of things.

Noel (05:44)

Yes, it's a beast, isn't it? But there are a lot of WordPress websites out there, obviously.

Katie (05:54)

Millions.

Noel (05:56)

Yes. And then you've got all the ones using WooCommerce for their stores and things like that. There are tons of those as well. So kind of a big problem. But really, it was a problem that's existed for, I think, over a decade, if not a bit more.

Katie (06:14)

Wow.

Noel (06:15)

So this isn't a new thing. But basically, the new AI models were finding ways to have almost a multi-step attack on the PHP code. And it found the straw that broke the camel's back, and then it was like, right, that's it, now I can get all of your credentials and get access to all kinds of secure information on anything that runs PHP.

Noel (06:40)

That could be websites, it could be WooCommerce stores, people could have web apps which use PHP in the background that have been around for a number of years. So kind of a big problem. A lot of government agencies actually use it as well, which is quite funny. So a lot of countries were pulling the plug on their government services because they were prone to the attack as well. So it was an interesting time, trying to figure out how we get around this.

Katie (07:17)

So how serious would you say the PHP flaw is for a business owner with, say, just a simple WordPress site?

Noel (07:29)

I guess with simple, maybe not so much. It depends if you've put your login information in there. Obviously you've got to log in on the admin dashboard, so hackers could get access to your website, which isn't ideal.

Noel (07:49)

And if you've got contact forms, they could potentially get in the middle of those and start taking people's information, which isn't ideal either. So it all depends what you have running on there. But I would say it's definitely something that needs updating, even if you only run a small WordPress website.

Katie (08:10)

Okay. So we're always told, aren't we, keep your plugins updated with a WordPress site. But how does this actually change the advice of just keep your plugins updated?

Noel (08:31)

I don't think it does. That advice is still very valid. Always keep on top of it, they're always changing. I even remember back when I used to help with the WordPress website, there was almost an update every couple of weeks, wasn't there? It's a bit of a job to keep up with, and then it breaks plugins and they've got to be updated. So I know it can be a bit of a chore, but it is very much essential.

Noel (08:55)

But there are also potential flaws in the code which AI hasn't yet found and we don't know about. So could this happen again? Very much so. But just keep on top of it.

Katie (09:11)

Okay, so as we normally do. At least once a month.

Noel (09:21)

Definitely, yeah.

Katie (09:23)

So if someone thinks they may have been affected by this security breach, what should they do?

Noel (09:33)

I guess it's going in, logging into your admin panels and making sure everything is up to date. If you've coded anything with, say, Claude Code or Codex, they're actually popping up with a little notice every time you make a change, saying, we need to update PHP, does your site or platform have it, yes or no? If no, it just ignores it. But if it does, it will go off and update it for you. So if you're vibe coding any apps, that has kind of been sorted out for you. But if you're doing it manually, then go into your platform, your control panels, whatever it might be, and make sure everything is 100% up to date.

Katie (10:18)

Okay. How does this apply to automation platforms that I know a lot of our listeners use, like Make or Zapier?

Noel (10:33)

At the moment I haven't seen anything come out to say they're worried about it. Their platforms remained online, as far as I'm aware, throughout the entirety of the internet being on fire last week. So that's always a good thing.

Noel (10:50)

But I would say they are a high value target, aren't they, in the grand scheme of things? Because they hold all kinds of API keys and credentials that we hold dear and don't want people to access. So I think their security teams will be working day and night to make sure everything's all good. Because as soon as that goes, their credibility disappears, doesn't it? Which is not ideal.

Katie (11:19)

Yeah, it really is. So I guess we shouldn't be using one master key everywhere. We should be using separate keys per tool, or even per client.

Noel (11:36)

Yes, absolutely. Especially when it comes to AI keys, or any key. Definitely have multiples. I know that can be a bit of a pain to manage, but with our AI keys, the platforms allow you to break it down into workspaces. So I have a workspace for Clyde and then other projects, so I can keep track of the usage for each account, and I've got all the keys there for each of those accounts. So the AI platforms allow you to do that, which makes life a lot easier.

Noel (12:05)

Obviously with other platforms like Gmail, it does get a bit trickier with that sort of thing. But I would never use the same key more than once.

Katie (12:20)

Okay. So my next question is really in two parts. The first is about spending caps and billing alerts on AI accounts. How much would they have saved people here?

Noel (12:44)

Lots. There was another hack on a platform called OpenCode, which is a coding platform. You can bring all kinds of AI API keys to it and use different coding agents to do whatever you need to do. That had a big breach where API keys were taken, and then their spend was used in another attack. So people were paying to attack another website, or whatever.

Noel (13:15)

So having those sorts of protections in place I think is always a must. A lot of people, especially if you're running a platform where people log in and use your API key to do AI things on your site or app, obviously have to have auto top-up or auto billing turned on, because you don't want your customers to log in and go, well, there's no money in the pot, this feature's off.

Noel (13:50)

So I get it's hard to turn that off, but billing alerts and keeping an eye on those sorts of things is really key. But what I did find is that with any keys that had any sort of suspicious activity, the main AI platforms were turning them off. They'd spotted it and then just binned that key. That one's turned off, it's blocked. So at least they're proactive in that sense.

Katie (14:17)

Okay, so they were aware and they were being proactive about it. I think that's really good.

Noel (14:23)

Yes, definitely. They didn't catch everything, though. I wouldn't rely on it one hundred percent, but it is nice that they do it.

Katie (14:31)

No. Okay, so that sort of leads into my next question. Should platforms be forced, or have some sort of terms and conditions, to tell us users a lot quicker? Because I think it was Theo Browne who said Railway's email arrived about an hour after he had already rolled his keys, which means he'd already deleted the old key and put a new one in.

Noel (15:11)

Yes. I run a lot of things on the Railway platform, and again, that was a separate attack to PHP and everything else. Essentially, the private keys that run our applications were exposed.

Noel (15:30)

But platforms definitely need to be a lot quicker. For me on Railway, the first thing I knew about it was when I tried to push an update for Clyde and it just didn't go through. And I thought, that's a bit weird. That was about 7am UK time. But I didn't actually get an email until mid afternoon, if not evening, that same day, saying, by the way, there's been a huge breach, all of your keys have potentially been exposed, you should go off and change them.

Noel (16:00)

So it's like, well, you've known about this for a good eight hours and you haven't said anything to me. You could look on their status page and it would say, yes, we're down, we're investigating an issue, but it didn't once tell users what that issue was.

Noel (16:20)

So they definitely do need to be far quicker. Especially when it's an API key. It is a password which is potentially linked to your bank account, with your billing. So that's really important, and everyone needs to know as quickly as possible. I'm sure that's a lesson learnt for them.

Katie (16:44)

How does that make you feel as a user? Does it make you trust them less, or make you think, maybe I'm going to go and look for a different platform?

Noel (17:02)

Yeah, I did start looking at other platforms to start with.

Katie (17:06)

Oh, you did?

Noel (17:07)

Yeah, I had a little shop around. I haven't changed. I just think, in this world of AI cyber attacks, it's something that's going to continually happen, because these agents are smarter than the human security engineers trying to patch the holes. They'll find them a lot quicker and exploit them. So I think this is something we almost need to get used to.

Noel (17:35)

It is interesting. But I didn't change in the end, mainly because it's an absolute nightmare to switch everything across, for a start. And I've got users who are already using the platforms that I host on there. So it could get messy very, very quickly.

Katie (18:03)

Okay. So have you decided to stick with them?

Noel (18:07)

Yeah, I'm going to stick with them. But I think the lesson I've learnt personally is finding where the off switch is. If I need to kill an app, how do I go off and do it? What actions can I take to just stop things from happening?

Noel (18:25)

I had this conversation earlier this week with a business partner, because we have an app hosted on Railway as well. Thankfully it's not open to customers currently. But it's one of those talking points. How on earth do we get around this? Well, we just need to find the button to pause it and knock it off.

Noel (18:50)

And as soon as I found out what the attack was and why it was down, I was like, right, we need to get a new API key in for our AI service. So that was pretty quick and secure, we managed to delete that key. But we could have done with that notification eight hours earlier. I guess that would have been bad press for them, maybe. The PR team were probably like, God, don't tell anyone what it is.

Katie (19:17)

Well, they kind of went from PR to crisis management, didn't they? Awkward.

Noel (19:21)

Yeah, I think so. Just a little.

Katie (19:28)

Okay. So we've learnt a lot during this episode, but for the too long, didn't read version: if listeners can take away just one action this week, what should it be?

Noel (19:48)

So the one action would be to go off and check everything your applications or websites are running. You can just have a chat with Claude, ChatGPT or Gemini, and they can find out the code versions that are running on your particular site or service. They can tell you straight away, which is really, really handy. So I would definitely do that. And then, if you need to take action, do it as soon as possible.

Katie (20:17)

Okay. And if anyone's concerned or worried that it might have affected their WordPress site, or apps that they use, what can they actually do to find that information out?

Noel (20:38)

So it's actually incredibly hard to find out exactly whether something's been taken, or whether your site has been breached. It's not that straightforward. So I just think, if you find something does need updating, just go off and do it as soon as you can.

Noel (21:00)

And then it's just keeping an eye out, I guess. Say you've got an app and your users are saying, I'm starting to get tons of random emails. That could potentially be part of a breach. Or maybe they're getting phishing emails that look like they're coming from you, or from the platform or website that you run. Those are the sorts of things I would say to keep an eye out for.

Katie (21:22)

Okay, great, amazing. Well, thank you for sharing your knowledge and experience, as always, Noel. We do hope you have found this episode really helpful. As always, if you want to get in touch with us, you can email us, hello@makeautomations.ai, or come over to our free LinkedIn group, which is called AI Automations for Business. And we will catch you next time for another episode very soon.