But the details reveal just how close things came to disaster. Word of the vulnerabilities began circulating online two days before the patch’s scheduled release, prompting PHP’s maintainers to bring it forward by a day. Hours later, with the patch still unavailable, Calif mistakenly posted a video showing its exploit at work, and copycat attempts multiplied. Cloudflare counted thousands before the public announcement, tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and eventually millions. Even after the patch was released, many webpages, including those of government agencies and parts of Wikipedia, were taken down as a precaution as security teams scrambled to install the update.
“If it had leaked a month earlier,” before a patch was ready, “this would have been a very different situation,” says Tomer Schwartz, co-founder and CTO at Wiz.
That a patch was prepared was the result of a loosely organized sprint. After Calif and Wiz sent reports to PHP, the groups joined forces. Researchers from competing companies shared their findings in common channels, with no contracts governing the arrangement. Over the following weeks, the group of roughly 15 people spoke almost daily to trace the vulnerabilities to their common source and devise a fix. The process, Schwartz says, was “just based on trust.”
Leave a Reply