It's Happening... AI Just Started the Biggest Internet Nightmare in History — Transcript

Full transcript

1. 0:0227 major cyber attacks and security
2. 0:04incidents hit the internet in just 48
3. 0:07hours. Governments across Europe yanked
4. 0:09their own websites offline. Japan's
5. 0:12prime minister went on X asking regular
6. 0:14people to check their servers. And a
7. 0:16company that vouches for websites being
8. 0:18safe turned out to be guarding its
9. 0:20master keys with the number four. People
10. 0:22are calling it the darkest October and
11. 0:25AI is in the middle of almost all of it.
12. 0:27finding the holes, exploiting them, and
13. 0:29sometimes wrecking things all by itself.
14. 0:32So, every app sits on a stack of
15. 0:34software layers. And this week, nearly
16. 0:36every layer cracked. [music] At the
17. 0:38bottom is Linux, running most of the
18. 0:41world's servers and basically the whole
19. 0:43cloud. Cloud companies split one big
20. 0:45machine into sealed off virtual machines
21. 0:48rented to different customers. On
22. 0:50October 15th, a bug went public that let
23. 0:53someone inside one of those break out
24. 0:55and grab root, meaning full admin
25. 0:57control over the host and everyone on
26. 0:59it. An autonomous AI security engine
27. 1:02from pone.ai found it, and Lionus
28. 1:05Torvalds merged the fix a day earlier.
29. 1:07Add another Linux bug handing regular
30. 1:10users admin rights, plus a TIDB database
31. 1:13flaw. One layer up is EngineX, the
32. 1:16software standing at the front door of
33. 1:18millions of websites. On October 14th,
34. 1:20it patched five bugs, three rated 9.2
35. 1:23out of 10. Some let a crafted request
36. 1:26overflow memory and run the attacker's
37. 1:28code or crash the site. And one breaks
38. 1:30the check where both sides show ID
39. 1:32badges so attackers walk right past it.
40. 1:34Then GitLab, where tons of companies
41. 1:37keep their code and the automated
42. 1:39pipelines that push updates live. It got
43. 1:42two perfect 10 out of 10 bugs on October
44. 1:4412th and 21st, letting anyone take over
45. 1:47a self-hosted GitLab server without
46. 1:49logging in. On October 20th, Chrome 156
47. 1:52shipped with 353 security fixes. A year
48. 1:56ago, Chrome 141 and 142 had 21 and 26.
49. 2:01Six were critical, including a 9.6 where
50. 2:04a booby trapped web page could escape
51. 2:06Chrome's sandbox. Four of those six came
52. 2:09from anthropic researcher Xinyang J, one
53. 2:12found with Claude's help, and one more
54. 2:13from OpenAI's codec security. So, five
55. 2:16of six came from AI companies. Then came
56. 2:19the night of October 21st. Finland shut
57. 2:22down all its government's online
58. 2:23services. The Netherlands took down its
59. 2:26digital ID system, Digid, government
60. 2:28portals, the Port of Roderdam, and
61. 2:30several hospitals. And even the Dutch
62. 2:32cyber security center switched off its
63. 2:34own site, which is a bit like the fire
64. 2:36department evacuating the fire station,
65. 2:38but honestly, correct call. France
66. 2:41ordered every provincial government site
67. 2:43offline, and Germany, Belgium, Wikipdia,
68. 2:46and Nintendo pulled services, too. In
69. 2:48Japan, Pixive and Nikono went into
70. 2:51emergency maintenance. The sushi chain
71. 2:53Sushiro paused its ordering app, and
72. 2:55Final Fantasy 14 players in China had to
73. 2:57switch launchers. All of them unplugged
74. 3:00themselves before anyone broke in. The
75. 3:02reason is PHP, the language running the
76. 3:04back kitchen of the internet. Log in,
77. 3:07search or comment on a site, and PHP is
78. 3:10usually what's handling it. WordPress,
79. 3:12Drupal, Joomla, Magento, and the
80. 3:15software behind Wikipedia all run on it.
81. 3:17And W3 Tech says it powers 69.3% of
82. 3:21websites with an identifiable backend
83. 3:23over 33 million sites, while second
84. 3:26place sits at 8.1%.
85. 3:29The two bugs, nicknamed PHP2 Shell, let
86. 3:32one request get an attacker a shell, a
87. 3:35command line on your server, so total
88. 3:37control, no password needed. Both are
89. 3:39rated 9.2 and Watchtower gave them a
90. 3:42full 10. The first one is about running
91. 3:44out of memory. PHP slams an emergency
92. 3:48stop and at exactly the wrong moment
93. 3:50that leaves data half set up which the
94. 3:52cleanup treats as real. So on Apache an
95. 3:54attacker can run code before the
96. 3:56website's own code even starts. The
97. 3:58second is about leftovers where the next
98. 4:01request reuses memory PHP already threw
99. 4:04away which can run code or leak other
100. 4:06users passwords and API keys. Whiz said
101. 4:09even a bare hello world site is
102. 4:11affected. Cloudflare says this goes back
103. 4:13over a decade to PHP 5.4. 4 and Vulkar
104. 4:17Dush of the PHP Foundation compared it
105. 4:19to heartbleleed in 2014. Patches only
106. 4:22cover versions 8.2 through 8.5, while
107. 4:2527% of PHP sites still run version 7 and
108. 4:297.7% run version 5, which get no fix.
109. 4:32The release was planned for October
110. 4:3422nd, but on the 20th it leaked on
111. 4:36Hacker News and Breach forums.
112. 4:38Watchtower confirmed it within hours and
113. 4:40PHP moved the patch up a day. That
114. 4:43night, Califf, one of the finders,
115. 4:45accidentally posted a demo of its attack
116. 4:47hitting real targets. And next morning,
117. 4:49Chain Guard, a distributor with early
118. 4:51access, broke its non-disclosure
119. 4:53agreement and shipped the fix early,
120. 4:55which is basically a treasure map for
121. 4:57attackers. Cloudflare saw attacks 6
122. 5:00hours before the official patch. The
123. 5:02NSA, Britain, and the EU said to take
124. 5:04unpatched sites offline, and Prime
125. 5:07Minister Sanai Takahichi told Japan to
126. 5:09get ready for the 11 p.m. patch. OpenAI
127. 5:12then counted PHP2 Shell as an AI win for
128. 5:15GPT 5.6 Soul, its cheaper model. Califf
129. 5:19says researcher Ryan Austin found it
130. 5:21first on August 5th using public models,
131. 5:24and his edge was history. Stefan Esser
132. 5:26found a similar PHP memory bug in 2004.
133. 5:29[music]
134. 5:30A related 2020 bug report got ignored,
135. 5:32and a 2024 audit funded by Germany's
136. 5:35sovereign tech agency spotted this exact
137. 5:37flaw. But nobody could prove it was
138. 5:39exploitable and every fix broke
139. 5:41something so it stalled. Writer Nick
140. 5:43Rogers calls this security by
141. 5:44exhaustion. Turning a bug like this into
142. 5:46a working attack took weeks of tedious
143. 5:49manual debugging so nobody bothered and
144. 5:51tons of old internet code is protected
145. 5:53that way. Then in June, Open AI's
146. 5:55patched the planet started funding
147. 5:57audits of open source software. Califf
148. 5:59picked PHP and around August 1st an AI
149. 6:02agent spotted the key flaw within days.
150. 6:05Then the AI turned that bug's pattern
151. 6:07into a reusable skill file which found
152. 6:09the second bug. Open AAI independently
153. 6:11reported the same root cause on August
154. 6:1311th, the same day as Caiff. Whiz owned
155. 6:16by Google found it separately on August
156. 6:1919th with Gemini 4 Argon and GPT 5.6
157. 6:22Soul had working takeovers on Drupal and
158. 6:25WordPress within 2 days and said one
159. 6:27researcher did in a week what used to
160. 6:29take top teams months. Oh, and on
161. 6:32October 21st, [music] node JS, which
162. 6:35runs behind PayPal, Netflix, and
163. 6:38LinkedIn, [music]
164. 6:39fixed 10 security bugs. The worst
165. 6:41letting a malformed, compressed file
166. 6:44leak secrets or run code. And Go patched
167. 6:47a flaw letting forge certificates trick
168. 6:49cloud services into trusting each other.
169. 6:51Now, the number four, the padlock in
170. 6:54your browser means your data is
171. 6:55encrypted. So, the routers between you
172. 6:57and a website pass it along without
173. 7:00reading it. that relies on certificate
174. 7:02authorities, trusted middlemen vouching
175. 7:04for websites. Emodra, an Indian one, had
176. 7:07eight intermediate certificates able to
177. 7:09vouch for almost any site with private
178. 7:12keys that should have 2 to the power of
179. 7:14384 [music]
180. 7:15possibilities. Instead, every bite was
181. 7:18zero except the last, leaving 256.
182. 7:22Researcher Scott Helm said one key was
183. 7:24just four, others were 56 and 115, and
184. 7:28he cracked them all on his laptop in
185. 7:30under a second. Others found 66,
186. 7:34155, 156, 230, and 237. The combination
187. 7:39lock on my gym bag has a thousand codes,
188. 7:42so my socks were better protected. With
189. 7:44those keys, someone could make a fake
190. 7:46bank site look legit or sit on your
191. 7:48network reading your chats and injecting
192. 7:50fake you want a prize popups. Chrome,
193. 7:53Firefox, Apple, and Microsoft began
194. 7:57distrusting the certificates from the
195. 7:5817th. Apple revoked them all on the 21st
196. 8:01and restored three a day later. Firefox
197. 8:04pulled 12 and 6 days in, WeChat's
198. 8:07built-in browser still accepted one. You
199. 8:09can check your browser at Emmudra. We
200. 8:11have a problem. Immudra's stock fell its
201. 8:1420% daily limit, and the cause was staff
202. 8:16forgetting to swap out a weak key used
203. 8:18for migration testing. Smart cameras,
204. 8:21speakers, and old servers that never
205. 8:23update will keep trusting these
206. 8:25certificates for years. AI keys are the
207. 8:28new target, too. Light LLM, which
208. 8:30connects apps to AI models and gets 23
209. 8:33million downloads a week, had version
210. 8:351.17.0
211. 8:38poisoned through stolen publishing
212. 8:40credentials. So the GitHub code looked
213. 8:43clean while what you installed was
214. 8:44infected and it usually holds your API
215. 8:47keys. On October 17th, the coding tool
216. 8:50Open Code was breached, possibly
217. 8:52exposing OpenAI, Anthropic, and Google
218. 8:55keys for 1.4% of its console users in
219. 8:58what it tied to a distillation attack,
220. 9:01basically using stolen access to copy a
221. 9:03model. Some users woke up to bills from
222. 9:05a few hundred to over $1,700.
223. 9:09On October 21st, the hosting platform
224. 9:11Railway said an outsider decrypted some
225. 9:14customers stored passwords and API keys
226. 9:17likely to steal AI computing and paused
227. 9:20all deployments, restarting them in
228. 9:22stages the next day. With pay-per-use
229. 9:25AI, a leaked key is a stolen credit card
230. 9:28and railway shows up again. In April, a
231. 9:30developer at car rental startup Pocket
232. 9:32OS had Claude Opus 4.6 in cursor fixing
233. 9:36a test environment credentials issue.
234. 9:38The agent found an overpowered railway
235. 9:40token on its own and in 9 seconds
236. 9:43deleted the production database and its
237. 9:45backups unasked. Founder Jeremy Crane
238. 9:48says the agent admitted it never checked
239. 9:50which environment it was in and broke
240. 9:52its own safety rules, which is a very
241. 9:54polite way of saying sorry about your
242. 9:57company. Actual attackers are on board,
243. 9:59too. Several South Korean financial
244. 10:01institutions were breached starting in
245. 10:03late September and Crowdstrike says the
246. 10:05attackers used Artex, an open- source AI
247. 10:08hacking agent with large language
248. 10:10models. Their exposed server held Claude
249. 10:12Code chat logs asking where to sell
250. 10:14leaked Korean data and which Telegram
251. 10:16groups trade it. Anthropic September
252. 10:19report adds Russia linked AI agents
253. 10:21rewriting malware whenever it got
254. 10:22flagged. a Chinese-speaking group whose
255. 10:25agents produced over a dozen suspected
256. 10:27zero days in a month and a lone hacker
257. 10:29whose AI written WordPress exploit got
258. 10:32into 14 of 42 targets. Crowdstrike says
259. 10:35AI powered attacker activity jumped 89%
260. 10:39in 2025 and the average time from
261. 10:42breaking in to spreading inside a
262. 10:43network fell to 29 minutes, the fastest
263. 10:46at 27 seconds. Sometimes there's no
264. 10:49attacker at all. In June, OpenAI
265. 10:51admitted GPT 5.6 Soul and a stronger
266. 10:54unreleased model escaped their test
267. 10:56environment and got into Hugging Faces
268. 10:58systems. [music] Anthropic reviewed
269. 11:00141,06 test runs and found three where
270. 11:04AI broke into real companies. And on
271. 11:06October 15th, Indian authorities said AI
272. 11:09models under testing repeatedly got into
273. 11:11live systems at Indian companies reading
274. 11:13confidential records unnoticed. On
275. 11:15defense, Anthropics Frontier Red Team
276. 11:18and Theorem Labs just dropped something
277. 11:20huge. Google's OSS Fuzz has spent a
278. 11:22decade throwing random inputs under one
279. 11:24megabyte at programs, trillions of
280. 11:27tests, but any path it misses can hide a
281. 11:29bug forever. Here, Claude had to
282. 11:32mathematically prove no input under 64
283. 11:34megabytes could trigger certain crashes
284. 11:36on any possible path down to the raw
285. 11:39instructions the chip runs. When a proof
286. 11:41got stuck, it was either a missing proof
287. 11:43or a real bug. So Claude patched it and
288. 11:46kept going. In a few weeks, it verified
289. 11:48239 entry points across 123 projects
290. 11:53with 180 million lines of proof passing
291. 11:55a strict checker called rock out of
292. 11:58about a billion written and found
293. 12:00hundreds of bugs, including ones
294. 12:02trillions of fuzzing runs missed, like a
295. 12:04decompressor bug that only triggers with
296. 12:06a roughly 20 megabyte file in a super
297. 12:08rare pattern. [music] In one popular PDF
298. 12:11reader, Claude found a year's worth of
299. 12:13bugs in a week. And when the team
300. 12:14planted seven bugs in a Python
301. 12:16interpreter, random testing missed five,
302. 12:19while the proofs caught all seven. The
303. 12:21tiny CJSON library has a 391 line entry
304. 12:24point and a 630,000line proof. Claude
305. 12:28even wrote its own model of x86, the
306. 12:30instruction language of Intel and AMD
307. 12:33chips, accurate enough to boot Ubuntu,
308. 12:35and found hundreds of errors in the
309. 12:37official x86 manual, plus a few bugs in
310. 12:41the CPUs themselves. The cell 4 kernel
311. 12:44took two person years to write [music]
312. 12:45and 20 to verify. So this used to be
313. 12:48reserved for Airbus flight controls. Now
314. 12:50Opus 5.5 needs about 40% fewer tokens
315. 12:54than Opus 5. Proof speed doubles every 2
316. 12:57months and proofs get reused since
317. 12:59OpenSSL alone sits under about 16,000
318. 13:02packages. Theorem prices its road map at
319. 13:05$134 million. Chain Reaction, a
320. 13:0810-person Chinese startup, just raised a
321. 13:10seed round of several million yuan on
322. 13:13the same idea. Its AI agent, Kairen, was
323. 13:16the only one to solve all 54 challenges
324. 13:18at Tencent Cloud's hacking contest,
325. 13:20placing third of 610 teams, and its new
326. 13:23cyber AI hacker runs a whole attack
327. 13:26simulation alone. Founder Ku wants to
328. 13:29charge by tokens like an AI lab and 70%
329. 13:32of 100 trial users agreed. Some of them
330. 13:36months old companies already hacked.
331. 13:38Open AAI says PHP2 Shell is only part of
332. 13:41the critical bugs it's still fixing
333. 13:43[music] and expects similar finds to
334. 13:45surge in the coming months. When AI
335. 13:47finds decade old bugs in minutes and
336. 13:49companies need weeks to patch, that gap
337. 13:52decides everything. Go update your
338. 13:54stuff. Thanks for watching and I'll
339. 13:56catch you in the next one.