Nick Worner 0:00

Hi, I'm Nick Warner. Welcome to the very first episode of TRG's Explain It to a Marketer. In this recurring series, we talked to one of our many subject matter experts at both TRG and Inversion 6 and asked them to break down their topics in terms so simple that even a member of the marketing team can understand. In this episode, we talked with Josh Fenton, VP of Security Services at Inversion 6. We asked Josh to join us to break down the rise of AI discovered cybersecurity vulnerabilities, specifically a recent vulnerability within PHP that freaked out the entire internet.

Enjoy the episode. Josh Fenn, VP of Security Services. Welcome to the very first episode of Explain It to a Marketer. You're our first guest.

Josh Fenton 0:37

Yeah. Thanks Nick. I'm happy to be here.

Nick Worner 0:39

Great, great. So what we call Jennyer for today is we need some help explaining it to a marketer regarding this PHP drama that we all read about at the end of last week. And I'm gonna be honest with you, PHP sounds like some kind of drug to me. I don't know anything about it. So let's start with that. What is it and what what are we all worried about here?

Josh Fenton 0:55

Yeah, so I mean I think the most simple way to explain what PHP is, is it's a programming language. So it is kind of the the glue behind a lot of internet applications. Very easy to, you know, translate data or databases into visual format. It's used by about 70% of websites that kind of exist out on the internet. So, you know, if you talk about you know, major telecommunications providers or, you know, streaming video game services or things like WordPress or Magneto, which are like carts or websites that are developed kind of by smaller organizations or small businesses, that all runs with some, you know, piece of that PHP library within it.

Nick Worner 1:44

And my understanding, if I read the stories correctly, is that this AI discovered this vulnerability. Yes, this is something that was kind of laying there for years and nobody noticed.

Josh Fenton 1:51

Yeah, I mean, people have been trying to get rid of a programming language like PHP since nineteen ninety-five, right? Hey, learn this new thing. You know, this thing's antiquated. But again, it's easy, it works, so it's out there. So I think we are living in a a new world when it comes to vulnerabilities. And, you know, AI just moves so much faster than a human can. And I think, you know, whether it's, you know, the intention is good or the intention is bad, you know, AI has the ability to go through these programming languages, go through applications at such a rapid rate that this is probably our new normal for vulnerability disclosure.

Nick Worner 2:30

Got it. Now here's what we're really gonna press you with explain it to a marketer because I'm gonna ask you what this vulnerability actually does. And you have to keep in mind how little I understand about programming languages.

Josh Fenton 2:40

Yeah, sure. So once the vulnerability was made aware, right? And AI and you know, there's multiple different websites from security news, and even I saw it, you know, on Yahoo and CNN, right? Once a vulnerability is out in the wild, that's where people then can write exploits against that vulnerability. For this vulnerability in particular, a exploit was written called PHP 2 shell. And what that basically means is I was able to launch a programmatic attack, let's say at a WordPress website, that would then give me shell access. And what us nerds, right, would call shell access is basically the ability to manipulate the back end of those websites and basically take control of it.

Nick Worner 3:29

So if the internet wasn't working properly for me last week, is that what's going on here? Has this actually hit ground in some places?

Josh Fenton 3:35

Yeah, most likely. I mean there while organizations are, you know, slow to admit that they're using incredibly dated you know programming languages, they are. Everybody does. So, you know, there were some major, as I mentioned earlier, some major telecommunications providers. One of the most popular video game companies had it took their site offline. Now, none of them said it was because of PHP, but you know, I think that you know, we can maybe make some assumptions there.

Nick Worner 4:05

Got it. Okay. It's good to know. So like you mentioned, this is kind of broken into mainstream news. You know, I got this in my news feed. So explain it like how much do I personally need to be freaking out about this versus a company level people who are building sites? Like help me understand that a little bit.

Josh Fenton 4:19

Yeah, so I mean if you're a small business, you know, and you're selling things on, you know, a WordPress website or a Magneto website, or even potentially on, you know, some of the larger kind of co-managed selling sites, I think you should be concerned. You know, I think you should probably reach out to, you know, if your buddy Bob is managing your personal website for whatever trinkets you might be selling, or maybe you're using a larger enterprise like a WordPress site, you know, I think you should probably reach out to who's where that's hosted and who's managing it, and just make sure that you know that it's fully patched and that you're secure and safe. And make sure you get that back in documentation as well. You know, if you're a large enterprise, you know, this is just the next vulnerability in the long list of vulnerabilities that you know might be sitting within an organization. And while no tool can solve that, knowing what assets you have in your network, what applications, what systems in your network, having good asset management is a foundational control to solving that. At inversion six, we actually have a tool. We call it tarot, you know, like the like the cards, right? Which is going to help you read your risk. And what it does is it takes all of that asset information, it matches it against the national the national vulnerability database that produces and categorizes all vulnerabilities.

And then it basically can tell you at what stage in kind of the risk lifecycle your organization is at for a vulnerability like PHP. So, you know, a you know, someone in charge can say, hey, where are we? And the tool within three clicks can say, Hey, actually we've patched it at, you know, at 95% of our endpoints, but there's this five percent and the the tickets with Sue and the roadblock is X.

And but it's going to be solved, right? So it's kind of a tool that looks at the entire risk exposure lifecycle and really pinpoints where it exists in your environment and it answers the four questions of where is it, what version, who owns it and you know, what do I need to do to solve it?

Nick Worner 6:36

Got it. So what I think I'm hearing you say is that you can prepare or assume to prepare for more things like this because this will not be the last thing like this that we see. And and basically get get ready because it's coming.

Josh Fenton 6:49

I think so. I think last week with all not just PHP, but Node.js, Java, there was a couple large enterprise firewall vulnerabilities as well. I think this is our new normal. I think with AI assisted vulnerability detection, I think that we're expecting this to kind of be what happens every single week. Now, I as a security practitioner for over twenty five years now, I love this. I think this is exciting.

And you know, jokingly I kinda looked at my staff and said, If this isn't fun for you and this isn't why you're here, maybe you should think about going to cut lawns for your for a living. Or go into marketing. No.

Nick Worner 7:31

That hurts, but it's very, very true. I'm glad you're excited. I'm glad somebody is. I'm a little less freaked out than I was before. So thank you. I think you actually have successfully explained this to a marketer. I certainly know more than I did before. And I think everybody more importantly who needs to be worried about this has a little more of an understanding about what to do. So I really appreciate it. I think we'll call that a successful first episode of Explain It to a Marketer. So thanks for making the first one a good one.

Josh Fenton 7:54

Yeah, thank you. Thanks for having me and I look forward to future episodes. This was really fun.

Nick Worner 7:58

Great. Take care, Josh.

Josh Fenton 8:00

You too.