Even The NSA Got Involved

PHP poned Node.js poned light LLM poned PHP poned Node.js poned light LLM poned GitLab you guessed it poned open code GitLab you guessed it poned open code GitLab you guessed it poned open code more like open poned and even railway more like open poned and even railway more like open poned and even railway got railed. It seems like pretty much got railed. It seems like pretty much got railed. It seems like pretty much everything just got hacked and the everything just got hacked and the everything just got hacked and the reason is cuz it did. This is horrible. reason is cuz it did. This is horrible. reason is cuz it did. This is horrible. This is one of the most unprecedented This is one of the most unprecedented This is one of the most unprecedented days in the history of software in terms days in the history of software in terms days in the history of software in terms of how many things just got destroyed. of how many things just got destroyed. of how many things just got destroyed. I've been trying to raise the alarm I've been trying to raise the alarm I've been trying to raise the alarm bells about this for a while now. It is bells about this for a while now. It is bells about this for a while now. It is not surprising to me that LLMs are now not surprising to me that LLMs are now not surprising to me that LLMs are now at the point where all of these types of at the point where all of these types of at the point where all of these types of things will happen. All that said, I things will happen. All that said, I things will happen. All that said, I actually feel a little bit bad about how actually feel a little bit bad about how actually feel a little bit bad about how I'm starting this video because it's I'm starting this video because it's I'm starting this video because it's almost misleading in a way. The reality almost misleading in a way. The reality almost misleading in a way. The reality is that two different things are is that two different things are is that two different things are happening at once right now. On one happening at once right now. On one happening at once right now. On one side, we have the CVE like with Node, side, we have the CVE like with Node, side, we have the CVE like with Node, GitLab, PHP, Quick, Light LLM, and more. GitLab, PHP, Quick, Light LLM, and more. GitLab, PHP, Quick, Light LLM, and more. These are all real open-source things These are all real open-source things These are all real open-source things that people rely on every day. They that people rely on every day. They that people rely on every day. They build their own software with the build their own software with the build their own software with the dependencies in our stack that have been dependencies in our stack that have been dependencies in our stack that have been discovered to have security issues that discovered to have security issues that discovered to have security issues that could be exploited in really scary, could be exploited in really scary, could be exploited in really scary, dangerous ways, especially the PHP side, dangerous ways, especially the PHP side, dangerous ways, especially the PHP side, which I promise we'll talk a lot about which I promise we'll talk a lot about which I promise we'll talk a lot about the impact of. The rest, however, are the impact of. The rest, however, are the impact of. The rest, however, are different. They're attacks. Railway and different. They're attacks. Railway and different. They're attacks. Railway and open code are not at all like the hacks open code are not at all like the hacks open code are not at all like the hacks on the left side here because these are on the left side here because these are on the left side here because these are actual attacks. These are incident actual attacks. These are incident actual attacks. These are incident reports of bugs that exist in software reports of bugs that exist in software reports of bugs that exist in software that could be exploited. Both of these that could be exploited. Both of these that could be exploited. Both of these are bad, but they're bad for very are bad, but they're bad for very are bad, but they're bad for very different reasons. And I actually think different reasons. And I actually think different reasons. And I actually think the right side here is what we should be the right side here is what we should be the right side here is what we should be way, way more scared of, even though way, way more scared of, even though way, way more scared of, even though everyone seems really focused on the everyone seems really focused on the everyone seems really focused on the left side here. I'm particularly left side here. I'm particularly left side here. I'm particularly concerned about how I've seen people concerned about how I've seen people concerned about how I've seen people covering the railway and open code hacks covering the railway and open code hacks covering the railway and open code hacks because there are important details as

because there are important details as because there are important details as to the wise and hows here that I just to the wise and hows here that I just to the wise and hows here that I just don't see being covered at all right don't see being covered at all right don't see being covered at all right now. I initially planned to make this now. I initially planned to make this now. I initially planned to make this two separate videos with a clear line two separate videos with a clear line two separate videos with a clear line drawn between these CVEes and the drawn between these CVEes and the drawn between these CVEes and the attacks, but I've realized that if I do attacks, but I've realized that if I do attacks, but I've realized that if I do split these videos up, people are going split these videos up, people are going split these videos up, people are going to watch one and not the other and then to watch one and not the other and then to watch one and not the other and then say really stupid [ __ ] which is why say really stupid [ __ ] which is why say really stupid [ __ ] which is why this video is likely a lot longer than I this video is likely a lot longer than I this video is likely a lot longer than I want it to be. Okay, technically LightM want it to be. Okay, technically LightM want it to be. Okay, technically LightM was an attack. We'll we'll clear that up was an attack. We'll we'll clear that up was an attack. We'll we'll clear that up in a bit. I want to do everything in my in a bit. I want to do everything in my in a bit. I want to do everything in my power to make sure you guys understand power to make sure you guys understand power to make sure you guys understand what's actually going on here and what what's actually going on here and what what's actually going on here and what we should be scared about. As I imagine we should be scared about. As I imagine we should be scared about. As I imagine the comment section for this video, I the comment section for this video, I the comment section for this video, I feel my sanity draining from my body. feel my sanity draining from my body. feel my sanity draining from my body. So, we're going to have to take a quick So, we're going to have to take a quick So, we're going to have to take a quick break so my sponsors can cover my break so my sponsors can cover my break so my sponsors can cover my therapy. The insane capabilities of the therapy. The insane capabilities of the therapy. The insane capabilities of the models from labs like Anthropic and models from labs like Anthropic and models from labs like Anthropic and OpenAI have put us in a weird OpenAI have put us in a weird OpenAI have put us in a weird contradictory place. On one hand, it's contradictory place. On one hand, it's contradictory place. On one hand, it's ever been easier to build big complex ever been easier to build big complex ever been easier to build big complex software. But on the other hand, the software. But on the other hand, the software. But on the other hand, the same tools that made it possible to same tools that made it possible to same tools that made it possible to build this software are not making it build this software are not making it build this software are not making it possible to find the thing that matters, possible to find the thing that matters, possible to find the thing that matters, security issues. It's ever been easier security issues. It's ever been easier security issues. It's ever been easier to put yourself in a position where you to put yourself in a position where you to put yourself in a position where you have these types of issues, but the have these types of issues, but the have these types of issues, but the models we use to actually try and fix models we use to actually try and fix models we use to actually try and fix things will refuse as soon as you try.

things will refuse as soon as you try. things will refuse as soon as you try. That's why I'm so thankful for Code That's why I'm so thankful for Code That's why I'm so thankful for Code Rabbit. You might be confused because Rabbit. You might be confused because Rabbit. You might be confused because aren't they using the same models that aren't they using the same models that aren't they using the same models that we are? Wouldn't they hit the refusals, we are? Wouldn't they hit the refusals, we are? Wouldn't they hit the refusals, too? The Code Rabbit security platform too? The Code Rabbit security platform too? The Code Rabbit security platform has this all figured out. They use the has this all figured out. They use the has this all figured out. They use the best models they can for the things that best models they can for the things that best models they can for the things that they're approved for and all the other they're approved for and all the other they're approved for and all the other models they need in order to do all of models they need in order to do all of models they need in order to do all of the rest. And the result is that you can the rest. And the result is that you can the rest. And the result is that you can get the security feedback that you need get the security feedback that you need get the security feedback that you need to make sure that you're shipping safe to make sure that you're shipping safe to make sure that you're shipping safe software. It all starts at the security software. It all starts at the security software. It all starts at the security dashboard which keeps track of where dashboard which keeps track of where dashboard which keeps track of where security issues are appearing and how security issues are appearing and how security issues are appearing and how many exist over time. As you would many exist over time. As you would many exist over time. As you would expect, the Code Rabbit code review expect, the Code Rabbit code review expect, the Code Rabbit code review includes the security review for every includes the security review for every includes the security review for every PR as it's filed. But if your codebase PR as it's filed. But if your codebase PR as it's filed. But if your codebase has been around for a bit or has has been around for a bit or has has been around for a bit or has anything in it that isn't being PRD anything in it that isn't being PRD anything in it that isn't being PRD right now, it might miss things. And right now, it might miss things. And right now, it might miss things. And that's why their deep scan feature is that's why their deep scan feature is that's why their deep scan feature is even cooler. You throw it at a repo, even cooler. You throw it at a repo, even cooler. You throw it at a repo, wait half an hour to an hour or so, and wait half an hour to an hour or so, and wait half an hour to an hour or so, and then you get back a detailed report of then you get back a detailed report of then you get back a detailed report of all the potential security issues, many all the potential security issues, many all the potential security issues, many of which map to real known of which map to real known of which map to real known vulnerabilities from existing patterns, vulnerabilities from existing patterns, vulnerabilities from existing patterns, libraries, etc. Not only do they give libraries, etc. Not only do they give libraries, etc. Not only do they give you these detailed breakdowns, they also you these detailed breakdowns, they also you these detailed breakdowns, they also give you this one-click fix button, give you this one-click fix button, give you this one-click fix button, which doesn't seem that important, cuz which doesn't seem that important, cuz which doesn't seem that important, cuz like you can screenshot this report and like you can screenshot this report and like you can screenshot this report and throw it at your agent until your agent throw it at your agent until your agent throw it at your agent until your agent refuses to fix it because Opus, Fable, refuses to fix it because Opus, Fable, refuses to fix it because Opus, Fable, and Soul, and Astra just refuse to do so and Soul, and Astra just refuse to do so and Soul, and Astra just refuse to do so much modern security work. Keep shipping much modern security work. Keep shipping much modern security work. Keep shipping fast without compromising your security fast without compromising your security fast without compromising your security at soy.code /code rabbit. Literally as I at soy.code /code rabbit. Literally as I at soy.code /code rabbit. Literally as I am filming, Oracle got hit. This one's a am filming, Oracle got hit. This one's a am filming, Oracle got hit. This one's a CVE. Does not appear to be an attack.

CVE. Does not appear to be an attack. CVE. Does not appear to be an attack. So, I'll put that in this column. I also So, I'll put that in this column. I also So, I'll put that in this column. I also think light LLM does not quite fit here think light LLM does not quite fit here think light LLM does not quite fit here because it wasn't a bug or something because it wasn't a bug or something because it wasn't a bug or something wrong with the light LLM codebase. It wrong with the light LLM codebase. It wrong with the light LLM codebase. It was a hijacking of GitHub actions that was a hijacking of GitHub actions that was a hijacking of GitHub actions that allowed for a sketchy malware version to allowed for a sketchy malware version to allowed for a sketchy malware version to be published on top of the existing be published on top of the existing be published on top of the existing light LLM. Honestly, that doesn't really light LLM. Honestly, that doesn't really light LLM. Honestly, that doesn't really fit in what I'm talking about today. So, fit in what I'm talking about today. So, fit in what I'm talking about today. So, I'm going to make the controversial I'm going to make the controversial I'm going to make the controversial choice to delete it because otherwise we choice to delete it because otherwise we choice to delete it because otherwise we will be doing this for far far far too will be doing this for far far far too will be doing this for far far far too long. As I mentioned earlier, the attack long. As I mentioned earlier, the attack long. As I mentioned earlier, the attack side is where things are most side is where things are most side is where things are most interesting and I would argue most interesting and I would argue most interesting and I would argue most important. But I have retention numbers important. But I have retention numbers important. But I have retention numbers to hit. So, we're going to get there in to hit. So, we're going to get there in to hit. So, we're going to get there in a bit and start with all of the CVEEs a bit and start with all of the CVEEs a bit and start with all of the CVEEs that were discovered today or at the that were discovered today or at the that were discovered today or at the very least were published today. For very least were published today. For very least were published today. For those who don't know, CVEEs are common those who don't know, CVEEs are common those who don't know, CVEEs are common vulnerabilities. This is a government-f vulnerabilities. This is a government-f vulnerabilities. This is a government-f funed program that tracks all of the funed program that tracks all of the funed program that tracks all of the different vulnerabilities that are different vulnerabilities that are different vulnerabilities that are discovered and disclosed in various discovered and disclosed in various discovered and disclosed in various pieces of software so that the severity pieces of software so that the severity pieces of software so that the severity of the incidents can be identified, of the incidents can be identified, of the incidents can be identified, discovered, and addressed. And there is discovered, and addressed. And there is discovered, and addressed. And there is a shared database effectively for a shared database effectively for a shared database effectively for tracking these things across various tracking these things across various tracking these things across various different companies, products, etc. The different companies, products, etc. The different companies, products, etc. The October 21st security release from Node October 21st security release from Node October 21st security release from Node is a good example of how this all works.

is a good example of how this all works. is a good example of how this all works. This updates for 26,24 and 22 based This updates for 26,24 and 22 based This updates for 26,24 and 22 based versions of Node.js. Security release versions of Node.js. Security release versions of Node.js. Security release includes the following dependency includes the following dependency includes the following dependency updates to address public updates to address public updates to address public vulnerabilities. There are vulnerabilities. There are vulnerabilities. There are vulnerabilities found specifically on vulnerabilities found specifically on vulnerabilities found specifically on OpenSSL as it worked in node 24 and 22. OpenSSL as it worked in node 24 and 22. OpenSSL as it worked in node 24 and 22. CS which I'm not familiar with the CS CS which I'm not familiar with the CS CS which I'm not familiar with the CS DNS library that's used in node had a DNS library that's used in node had a DNS library that's used in node had a CVE that has now been fixed on these CVE that has now been fixed on these CVE that has now been fixed on these three versions. SQLite undcerta is one of the companies that had the is one of the companies that had the ability to issue SSLerts. They had their ability to issue SSLerts. They had their ability to issue SSLerts. They had their private key set as the number four. private key set as the number four. private key set as the number four. Literally, while four is a really good Literally, while four is a really good Literally, while four is a really good random number, it's not necessarily the random number, it's not necessarily the random number, it's not necessarily the best password. So, not great that this best password. So, not great that this best password. So, not great that this key existed, much less is being abused key existed, much less is being abused key existed, much less is being abused the way it is. So, everything that the way it is. So, everything that the way it is. So, everything that honors theirs is screwed. And you need honors theirs is screwed. And you need honors theirs is screwed. And you need to make sure you're on the latest to make sure you're on the latest to make sure you're on the latest version of your browser and that version of your browser and that version of your browser and that allurerts are not considered valid allurerts are not considered valid allurerts are not considered valid anymore. You'll see here that all of the anymore. You'll see here that all of the anymore. You'll see here that all of the things they address have these CVE tags. things they address have these CVE tags. things they address have these CVE tags. These link to that shared database we These link to that shared database we These link to that shared database we were just on that show how severe the were just on that show how severe the were just on that show how severe the incidents are and how they have been incidents are and how they have been incidents are and how they have been fixed and addressed. This allows for fixed and addressed. This allows for fixed and addressed. This allows for companies to privately talk about these companies to privately talk about these companies to privately talk about these things before they go public. So, a lot things before they go public. So, a lot things before they go public. So, a lot of these reports probably were filed of these reports probably were filed of these reports probably were filed quite a bit ago and only are now being quite a bit ago and only are now being quite a bit ago and only are now being shared publicly because the biggest shared publicly because the biggest shared publicly because the biggest issue with a lot of this stuff is that issue with a lot of this stuff is that issue with a lot of this stuff is that when you fix the problem, there is a when you fix the problem, there is a when you fix the problem, there is a window from when the code that fixes it window from when the code that fixes it window from when the code that fixes it ships and everyone can see the code now ships and everyone can see the code now ships and everyone can see the code now knowing that there might have been a bug

knowing that there might have been a bug knowing that there might have been a bug or something that they could use for or something that they could use for or something that they could use for hacks and then the time from when that hacks and then the time from when that hacks and then the time from when that merge happens on the GitHub repo or merge happens on the GitHub repo or merge happens on the GitHub repo or wherever the code is to when people wherever the code is to when people wherever the code is to when people actually have the safe actually have the safe actually have the safe That window is dangerous. Historically, That window is dangerous. Historically, That window is dangerous. Historically, it hasn't been that dangerous because it it hasn't been that dangerous because it it hasn't been that dangerous because it would take enough effort to first off would take enough effort to first off would take enough effort to first off find the things that were patched. find the things that were patched. find the things that were patched. Second off, figure out what exactly they Second off, figure out what exactly they Second off, figure out what exactly they were actually patching. Third off, find were actually patching. Third off, find were actually patching. Third off, find a way to exploit the things that were a way to exploit the things that were a way to exploit the things that were patched, and then fourth and most patched, and then fourth and most patched, and then fourth and most importantly distribute those exploits importantly distribute those exploits importantly distribute those exploits before most people have updated their before most people have updated their before most people have updated their software. The vast majority of exploits software. The vast majority of exploits software. The vast majority of exploits that happen are happening on known that happen are happening on known that happen are happening on known vulnerabilities that have been fixed, vulnerabilities that have been fixed, vulnerabilities that have been fixed, but the software you're running doesn't but the software you're running doesn't but the software you're running doesn't have the fix applied yet. This is why have the fix applied yet. This is why have the fix applied yet. This is why it's so important to stay on the latest it's so important to stay on the latest it's so important to stay on the latest version of your operating system, the version of your operating system, the version of your operating system, the apps you use, your browser, your apps you use, your browser, your apps you use, your browser, your dependencies, and all these other dependencies, and all these other dependencies, and all these other things. For this all to make sense, I'm things. For this all to make sense, I'm things. For this all to make sense, I'm going to talk about it in what I'll going to talk about it in what I'll going to talk about it in what I'll refer to as the vulnerable window. This refer to as the vulnerable window. This refer to as the vulnerable window. This is the time in which there is an is the time in which there is an is the time in which there is an opportunity to exploit your software. opportunity to exploit your software. opportunity to exploit your software. This is a factor of various different This is a factor of various different This is a factor of various different things. This is how obvious is the things. This is how obvious is the things. This is how obvious is the problem as in like how obvious is the problem as in like how obvious is the problem as in like how obvious is the thing that was patched and how easily thing that was patched and how easily thing that was patched and how easily can you patch it. There's how long to can you patch it. There's how long to can you patch it. There's how long to get the patch out. This can vary a lot get the patch out. This can vary a lot get the patch out. This can vary a lot depending on different things. For depending on different things. For depending on different things. For example, if my server had a example, if my server had a example, if my server had a vulnerability on it that was discovered vulnerability on it that was discovered vulnerability on it that was discovered and disclosed, I only have to patch my and disclosed, I only have to patch my and disclosed, I only have to patch my one server and you are fine. But if one server and you are fine. But if one server and you are fine. But if software that you install on your device software that you install on your device software that you install on your device is pawned or a library you rely on is is pawned or a library you rely on is is pawned or a library you rely on is pawned, then you have to download the pawned, then you have to download the pawned, then you have to download the new version and redeploy or reinstall or new version and redeploy or reinstall or new version and redeploy or reinstall or whatever else that increases the amount whatever else that increases the amount whatever else that increases the amount of time it takes for users to have this

of time it takes for users to have this of time it takes for users to have this vulnerability patched. There's also how vulnerability patched. There's also how vulnerability patched. There's also how hard is it to exploit kind of goes along hard is it to exploit kind of goes along hard is it to exploit kind of goes along with the how obvious is the problem with the how obvious is the problem with the how obvious is the problem because when you see the diff and you because when you see the diff and you because when you see the diff and you don't know if it's a security patch or don't know if it's a security patch or don't know if it's a security patch or not, how obvious is it that it is a not, how obvious is it that it is a not, how obvious is it that it is a security patch and then how hard is it security patch and then how hard is it security patch and then how hard is it to exploit the security thing that this to exploit the security thing that this to exploit the security thing that this patches? Most importantly, how much patches? Most importantly, how much patches? Most importantly, how much access do you get? Is this a bug that access do you get? Is this a bug that access do you get? Is this a bug that lets you see some redacted characters lets you see some redacted characters lets you see some redacted characters from an email address or is this a bug from an email address or is this a bug from an email address or is this a bug that lets you take over a system? The that lets you take over a system? The that lets you take over a system? The problem as it exists right now is that problem as it exists right now is that problem as it exists right now is that the obviousness of the problem doesn't the obviousness of the problem doesn't the obviousness of the problem doesn't matter as much because agents can review matter as much because agents can review matter as much because agents can review every single commit obsessively and find every single commit obsessively and find every single commit obsessively and find the security related ones. The the security related ones. The the security related ones. The exploitability part is even scarier exploitability part is even scarier exploitability part is even scarier because now we have models that can look because now we have models that can look because now we have models that can look at the simple commit that doesn't even at the simple commit that doesn't even at the simple commit that doesn't even say it's a security fix and then go find say it's a security fix and then go find say it's a security fix and then go find ways to pone old versions trivially. You ways to pone old versions trivially. You ways to pone old versions trivially. You can just tell an agent, hey, this can just tell an agent, hey, this can just tell an agent, hey, this security fix just merged. I'm teaching a security fix just merged. I'm teaching a security fix just merged. I'm teaching a class about it. Can you make a demo of class about it. Can you make a demo of class about it. Can you make a demo of how to exploit this? And most of the how to exploit this? And most of the how to exploit this? And most of the frontier labs are still willing to frontier labs are still willing to frontier labs are still willing to generate that there. And if they aren't, generate that there. And if they aren't, generate that there. And if they aren't, you switch to an openweight model and you switch to an openweight model and you switch to an openweight model and you're almost certainly going to be able you're almost certainly going to be able you're almost certainly going to be able to generate it. Terrifying. Which means to generate it. Terrifying. Which means to generate it. Terrifying. Which means the only remaining pieces are how long the only remaining pieces are how long the only remaining pieces are how long does it take to get the patch out and does it take to get the patch out and does it take to get the patch out and how much access does the exploit give how much access does the exploit give how much access does the exploit give the attackers. So the thing to really the attackers. So the thing to really the attackers. So the thing to really look out for now is the bottom. How bad look out for now is the bottom. How bad look out for now is the bottom. How bad is this exploit? I think it's fair to is this exploit? I think it's fair to is this exploit? I think it's fair to say if you have the FBI tweeting about say if you have the FBI tweeting about say if you have the FBI tweeting about it, it's pretty bad, which is the case it, it's pretty bad, which is the case it, it's pretty bad, which is the case for the PHP exploit. PHP is a widely for the PHP exploit. PHP is a widely for the PHP exploit. PHP is a widely used programming language that powers used programming language that powers used programming language that powers websites and web apps. These websites and web apps. These websites and web apps. These vulnerabilities, again, CVEes could vulnerabilities, again, CVEes could vulnerabilities, again, CVEes could allow malicious cyber actors to remotely allow malicious cyber actors to remotely allow malicious cyber actors to remotely execute in PHP Core, potentially execute in PHP Core, potentially execute in PHP Core, potentially compromising sensitive data and

compromising sensitive data and compromising sensitive data and networks. The FBI urges organizations to networks. The FBI urges organizations to networks. The FBI urges organizations to take the following steps now. An take the following steps now. An take the following steps now. An immediate update is not feasible. It is immediate update is not feasible. It is immediate update is not feasible. It is recommended that organizations take the recommended that organizations take the recommended that organizations take the system offline until it can be fully system offline until it can be fully system offline until it can be fully mitigated. Immediately update affected mitigated. Immediately update affected mitigated. Immediately update affected PHP installations following the PHP installations following the PHP installations following the guidelines on PHP.NET. Inventory where guidelines on PHP.NET. Inventory where guidelines on PHP.NET. Inventory where PHP runs in your environment, PHP runs in your environment, PHP runs in your environment, prioritizing internetf facing systems prioritizing internetf facing systems prioritizing internetf facing systems and vendor products that bundle PHP. You and vendor products that bundle PHP. You and vendor products that bundle PHP. You should monitor web servers for should monitor web servers for should monitor web servers for suspicious activity, including PHP suspicious activity, including PHP suspicious activity, including PHP processes unexpectedly launching command processes unexpectedly launching command processes unexpectedly launching command shells or downloading files. Ensure shells or downloading files. Ensure shells or downloading files. Ensure appropriate process monitoring appropriate process monitoring appropriate process monitoring capabilities are in place to help capabilities are in place to help capabilities are in place to help identify potential exploitation. They identify potential exploitation. They identify potential exploitation. They even have a government site that you can even have a government site that you can even have a government site that you can report things to if you think you're report things to if you think you're report things to if you think you're being exploited. This tweet matters for being exploited. This tweet matters for being exploited. This tweet matters for two reasons. First off, it helps two reasons. First off, it helps two reasons. First off, it helps emphasize the severity of these CVEes. emphasize the severity of these CVEes. emphasize the severity of these CVEes. They're scored on a 1 to 10 scale. They're scored on a 1 to 10 scale. They're scored on a 1 to 10 scale. They're both 9.2s, and the colloquial They're both 9.2s, and the colloquial They're both 9.2s, and the colloquial term for the exploit that they enable is term for the exploit that they enable is term for the exploit that they enable is PHP to shell. It's a memory exploit that PHP to shell. It's a memory exploit that PHP to shell. It's a memory exploit that lets you get root access. Very, very, lets you get root access. Very, very, lets you get root access. Very, very, very bad. Just to emphasize the point I very bad. Just to emphasize the point I very bad. Just to emphasize the point I was making before about how important it was making before about how important it was making before about how important it is to have good disclosure pipelines to is to have good disclosure pipelines to is to have good disclosure pipelines to make sure that knowledge of these make sure that knowledge of these make sure that knowledge of these exploits doesn't go public too early.

exploits doesn't go public too early. exploits doesn't go public too early. One of the reasons this PHP exploit is One of the reasons this PHP exploit is One of the reasons this PHP exploit is so bad is because something in their so bad is because something in their so bad is because something in their chain broke security embargo ahead of chain broke security embargo ahead of chain broke security embargo ahead of these patches going out. PHP Foundation these patches going out. PHP Foundation these patches going out. PHP Foundation says Chain Guard broke a coordinated says Chain Guard broke a coordinated says Chain Guard broke a coordinated security embargo by releasing patched security embargo by releasing patched security embargo by releasing patched PHP container images hours ahead of the PHP container images hours ahead of the PHP container images hours ahead of the planned schedule, making the fix planned schedule, making the fix planned schedule, making the fix available for attackers to study while available for attackers to study while available for attackers to study while other distributors were still preparing other distributors were still preparing other distributors were still preparing updates. Again, as soon as there is any updates. Again, as soon as there is any updates. Again, as soon as there is any evidence of one of these exploits evidence of one of these exploits evidence of one of these exploits existing, agents can take advantage of existing, agents can take advantage of existing, agents can take advantage of it so fast. So, it is really, really it so fast. So, it is really, really it so fast. So, it is really, really important that by the time the info is important that by the time the info is important that by the time the info is known that we have a path to getting known that we have a path to getting known that we have a path to getting everything updated as quick as possible. everything updated as quick as possible. everything updated as quick as possible. The knowledge getting out early means The knowledge getting out early means The knowledge getting out early means everything is pretty bad. Lots of other everything is pretty bad. Lots of other everything is pretty bad. Lots of other things were pawned like GitLab, Quick, things were pawned like GitLab, Quick, things were pawned like GitLab, Quick, and Oracle. But I have one last thing I and Oracle. But I have one last thing I and Oracle. But I have one last thing I want to talk about with the PHP piece want to talk about with the PHP piece want to talk about with the PHP piece before we go further because I've seen before we go further because I've seen before we go further because I've seen some really bad takes about this. To be some really bad takes about this. To be some really bad takes about this. To be fair, this happens pretty much every fair, this happens pretty much every fair, this happens pretty much every single time PHP comes up. Do any of you single time PHP comes up. Do any of you single time PHP comes up. Do any of you guys have one of those PHP is 70% of the guys have one of those PHP is 70% of the guys have one of those PHP is 70% of the web. Everything is pawned tweets that web. Everything is pawned tweets that web. Everything is pawned tweets that people were making today because I'd people were making today because I'd people were making today because I'd really like one of those if someone has really like one of those if someone has really like one of those if someone has one easy access. Okay, I lied. There's one easy access. Okay, I lied. There's one easy access. Okay, I lied. There's actually two more things I need to actually two more things I need to actually two more things I need to complain about with the PHP thing. One complain about with the PHP thing. One complain about with the PHP thing. One of this is the call out that PHP is used of this is the call out that PHP is used of this is the call out that PHP is used to run an estimated 70% of websites.

to run an estimated 70% of websites. to run an estimated 70% of websites. I'll complain about that in a minute cuz I'll complain about that in a minute cuz I'll complain about that in a minute cuz there's a much funnier thing I wanted to there's a much funnier thing I wanted to there's a much funnier thing I wanted to mention in here. The PHP exploits mention in here. The PHP exploits mention in here. The PHP exploits weren't found with modern models. They weren't found with modern models. They weren't found with modern models. They were found with GPT 5.6 soul. This shows were found with GPT 5.6 soul. This shows were found with GPT 5.6 soul. This shows both how long it takes for these things both how long it takes for these things both how long it takes for these things to become public because again they have to become public because again they have to become public because again they have to try and protect these incidents and to try and protect these incidents and to try and protect these incidents and not make it as wellknown but also that a not make it as wellknown but also that a not make it as wellknown but also that a model as bad as 56 soul is able to find model as bad as 56 soul is able to find model as bad as 56 soul is able to find these exploits. There are multiple these exploits. There are multiple these exploits. There are multiple openweight models that are nearly as openweight models that are nearly as openweight models that are nearly as capable as 56 soul at this point. We are capable as 56 soul at this point. We are capable as 56 soul at this point. We are very screwed. Apparently another group very screwed. Apparently another group very screwed. Apparently another group whiz also independently discovered and whiz also independently discovered and whiz also independently discovered and reported these vulnerabilities. This is reported these vulnerabilities. This is reported these vulnerabilities. This is the other scary thing is if only one the other scary thing is if only one the other scary thing is if only one party is aware of these security issues. party is aware of these security issues. party is aware of these security issues. Cool. Awesome. Get it fixed before it's Cool. Awesome. Get it fixed before it's Cool. Awesome. Get it fixed before it's public. But if two can find it public. But if two can find it public. But if two can find it independently, that's a lot scarier. independently, that's a lot scarier. independently, that's a lot scarier. Similar to how we just had four Similar to how we just had four Similar to how we just had four independent groups rewrite all of independent groups rewrite all of independent groups rewrite all of TypeScript in Rust in roughly the same TypeScript in Rust in roughly the same TypeScript in Rust in roughly the same time window. If any one group is able to time window. If any one group is able to time window. If any one group is able to get modern models to discover an get modern models to discover an get modern models to discover an exploit, there are probably lots of exploit, there are probably lots of exploit, there are probably lots of others that are figuring it out around others that are figuring it out around others that are figuring it out around the same time. This also helps destroy the same time. This also helps destroy the same time. This also helps destroy this idea of private disclosures in this idea of private disclosures in this idea of private disclosures in order to prevent public software from order to prevent public software from order to prevent public software from being exploited as badly. Everything is being exploited as badly. Everything is being exploited as badly. Everything is falling apart is what I'm trying to say.

falling apart is what I'm trying to say. falling apart is what I'm trying to say. very slight silver lining is on the 70% very slight silver lining is on the 70% very slight silver lining is on the 70% of websites thing. I've been trying all of websites thing. I've been trying all of websites thing. I've been trying all day to come up with a good analogy for day to come up with a good analogy for day to come up with a good analogy for why this is really stupid. Okay, I have why this is really stupid. Okay, I have why this is really stupid. Okay, I have one. Did you know that the average one. Did you know that the average one. Did you know that the average person spends less than 1 hour a year on person spends less than 1 hour a year on person spends less than 1 hour a year on a screen? I know it seems insane cuz all a screen? I know it seems insane cuz all a screen? I know it seems insane cuz all of us have crazy screen time, but the of us have crazy screen time, but the of us have crazy screen time, but the average screen time for a human is under average screen time for a human is under average screen time for a human is under an hour a year. It's probably even less an hour a year. It's probably even less an hour a year. It's probably even less than that because I didn't specify than that because I didn't specify than that because I didn't specify living humans. If you include every living humans. If you include every living humans. If you include every human who ever lived and you average out human who ever lived and you average out human who ever lived and you average out all humans, the number goes down a all humans, the number goes down a all humans, the number goes down a bunch. Similarly, if you measure bunch. Similarly, if you measure bunch. Similarly, if you measure websites by the number of URLs served by websites by the number of URLs served by websites by the number of URLs served by PHP, you're doing a thing that's really PHP, you're doing a thing that's really PHP, you're doing a thing that's really [ __ ] stupid. Because the vast [ __ ] stupid. Because the vast [ __ ] stupid. Because the vast majority of websites on the internet are majority of websites on the internet are majority of websites on the internet are dead. I would bet if I check my open dead. I would bet if I check my open dead. I would bet if I check my open tabs in Chrome right now, almost zero of tabs in Chrome right now, almost zero of tabs in Chrome right now, almost zero of them are PHP websites. We got Railway, them are PHP websites. We got Railway, them are PHP websites. We got Railway, definitely not PHP. We got YouTube chat, definitely not PHP. We got YouTube chat, definitely not PHP. We got YouTube chat, which as slow as it is, also crazy which as slow as it is, also crazy which as slow as it is, also crazy enough isn't PHP. Twitter isn't PHP.

enough isn't PHP. Twitter isn't PHP. enough isn't PHP. Twitter isn't PHP. Twitch, been through it. Definitely not Twitch, been through it. Definitely not Twitch, been through it. Definitely not PHP. More Railway, not PHP. GitHub, not PHP. More Railway, not PHP. GitHub, not PHP. More Railway, not PHP. GitHub, not PHP. YouTube, not PHP. All of my other PHP. YouTube, not PHP. All of my other PHP. YouTube, not PHP. All of my other services here, things I built mostly, services here, things I built mostly, services here, things I built mostly, none of that is PHP. The point I'm none of that is PHP. The point I'm none of that is PHP. The point I'm trying to make here is, yeah, sure, 70% trying to make here is, yeah, sure, 70% trying to make here is, yeah, sure, 70% of websites are PHP. But that's a of websites are PHP. But that's a of websites are PHP. But that's a useless number because none of these are useless number because none of these are useless number because none of these are getting any traffic at all. I don't care getting any traffic at all. I don't care getting any traffic at all. I don't care if your old unmaintained WordPress blog if your old unmaintained WordPress blog if your old unmaintained WordPress blog from 2014 is pawned. I really don't. So from 2014 is pawned. I really don't. So from 2014 is pawned. I really don't. So yeah, is this going to be bad for the yeah, is this going to be bad for the yeah, is this going to be bad for the preservation of the web? Yeah, but preservation of the web? Yeah, but preservation of the web? Yeah, but WordPress is already bad for the WordPress is already bad for the WordPress is already bad for the preservation of the web. The if I preservation of the web. The if I preservation of the web. The if I recall, the majority of websites, like recall, the majority of websites, like recall, the majority of websites, like over 50% are WordPress. And WordPress is over 50% are WordPress. And WordPress is over 50% are WordPress. And WordPress is even more fragile than PHP by itself and even more fragile than PHP by itself and even more fragile than PHP by itself and has had a lot of incidents that I have has had a lot of incidents that I have has had a lot of incidents that I have personally been affected by. Like when I personally been affected by. Like when I personally been affected by. Like when I built my uncle a website for his like built my uncle a website for his like built my uncle a website for his like small fishing charter when I was in high small fishing charter when I was in high small fishing charter when I was in high school and then forgot about it and school and then forgot about it and school and then forgot about it and didn't maintain it, it got pawned to didn't maintain it, it got pawned to didn't maintain it, it got pawned to hell because I wasn't maintaining it. hell because I wasn't maintaining it. hell because I wasn't maintaining it. And that's the problem here. It's not And that's the problem here. It's not And that's the problem here. It's not just dead websites. It's dead people not just dead websites. It's dead people not just dead websites. It's dead people not maintaining their websites or people who maintaining their websites or people who maintaining their websites or people who left the job not updating their websites left the job not updating their websites left the job not updating their websites or random government stuff. Like things or random government stuff. Like things or random government stuff. Like things like that are [ __ ] That is a really like that are [ __ ] That is a really like that are [ __ ] That is a really big deal. The vast majority of websites big deal. The vast majority of websites big deal. The vast majority of websites getting actual traffic today are not getting actual traffic today are not getting actual traffic today are not using PHP. So, don't get too scared of using PHP. So, don't get too scared of using PHP. So, don't get too scared of these 70% numbers. I really wish we these 70% numbers. I really wish we these 70% numbers. I really wish we would stop talking this way because would stop talking this way because would stop talking this way because nobody thinks this way. Okay, I have nobody thinks this way. Okay, I have nobody thinks this way. Okay, I have said everything I really want to about said everything I really want to about said everything I really want to about the CVE side of things today. Believe it the CVE side of things today. Believe it the CVE side of things today. Believe it or not, that was the less interesting

or not, that was the less interesting or not, that was the less interesting and also less scary side because now we and also less scary side because now we and also less scary side because now we have to talk about the attacks. I'm have to talk about the attacks. I'm have to talk about the attacks. I'm going to start with the open code going to start with the open code going to start with the open code attack. For those who aren't familiar, attack. For those who aren't familiar, attack. For those who aren't familiar, open code got pawned a few days ago. open code got pawned a few days ago. open code got pawned a few days ago. This isn't like they got access to all This isn't like they got access to all This isn't like they got access to all of your data because like it's running of your data because like it's running of your data because like it's running on your own devices. Usually they're not on your own devices. Usually they're not on your own devices. Usually they're not even collecting that much data. The even collecting that much data. The even collecting that much data. The thing that was affected by the Open Code thing that was affected by the Open Code thing that was affected by the Open Code hack was API keys, not the Open Code hack was API keys, not the Open Code hack was API keys, not the Open Code ones, they rolled all those. Obviously, ones, they rolled all those. Obviously, ones, they rolled all those. Obviously, the issue is if you brought your own API the issue is if you brought your own API the issue is if you brought your own API keys to Open Code in their dashboard and keys to Open Code in their dashboard and keys to Open Code in their dashboard and on their server side. So if you set up on their server side. So if you set up on their server side. So if you set up open code with your account to have an open code with your account to have an open code with your account to have an API key for anthropic, open AAI, Gemini API key for anthropic, open AAI, Gemini API key for anthropic, open AAI, Gemini or whatever else, those keys all could or whatever else, those keys all could or whatever else, those keys all could have and often did get found and have and often did get found and have and often did get found and exploited. Many devs were reporting that exploited. Many devs were reporting that exploited. Many devs were reporting that their OpenAI and anthropic API keys got their OpenAI and anthropic API keys got their OpenAI and anthropic API keys got consumed and their OpenAI accounts were consumed and their OpenAI accounts were consumed and their OpenAI accounts were suspended. Did signal just get suspended. Did signal just get suspended. Did signal just get exploited? exploited? exploited? Uh, I saw people reporting abuse numbers Uh, I saw people reporting abuse numbers Uh, I saw people reporting abuse numbers from their leaked keys as low as 400 from their leaked keys as low as 400 from their leaked keys as low as 400 bucks and as high as three grand all in bucks and as high as three grand all in bucks and as high as three grand all in minutes from when the accounts and keys minutes from when the accounts and keys minutes from when the accounts and keys got found and exploited. Kind of crazy.

got found and exploited. Kind of crazy. got found and exploited. Kind of crazy. Lots of people were banned. Lots of Lots of people were banned. Lots of Lots of people were banned. Lots of people got a lot of money spent. people got a lot of money spent. people got a lot of money spent. Thankfully, Open Code has been working Thankfully, Open Code has been working Thankfully, Open Code has been working closely with the labs to get people closely with the labs to get people closely with the labs to get people refunded, to get their accounts refunded, to get their accounts refunded, to get their accounts reinstated, to deal with all of this, reinstated, to deal with all of this, reinstated, to deal with all of this, and also to automatically roll all of and also to automatically roll all of and also to automatically roll all of the keys. So, why would somebody hack the keys. So, why would somebody hack the keys. So, why would somebody hack Open Code just to get a bunch of API Open Code just to get a bunch of API Open Code just to get a bunch of API keys that all get revoked a few minutes keys that all get revoked a few minutes keys that all get revoked a few minutes later? Well, guess what? They did the later? Well, guess what? They did the later? Well, guess what? They did the same thing to Railway. Earlier this same thing to Railway. Earlier this same thing to Railway. Earlier this morning, Railway detected anomalous morning, Railway detected anomalous morning, Railway detected anomalous activity involving systems that store activity involving systems that store activity involving systems that store customer environment variables. After customer environment variables. After customer environment variables. After further investigation, our investigation further investigation, our investigation further investigation, our investigation to date indicates that an unauthorized to date indicates that an unauthorized to date indicates that an unauthorized third party may have accessed encrypted third party may have accessed encrypted third party may have accessed encrypted environment variables and for some of environment variables and for some of environment variables and for some of them obtained the decrypted contents. them obtained the decrypted contents. them obtained the decrypted contents. Environment variables may contain Environment variables may contain Environment variables may contain secrets such as API keys or database and secrets such as API keys or database and secrets such as API keys or database and registry credentials. This one really registry credentials. This one really registry credentials. This one really pissed me off because I have a bunch of pissed me off because I have a bunch of pissed me off because I have a bunch of [ __ ] deployed on railway. All of which [ __ ] deployed on railway. All of which [ __ ] deployed on railway. All of which is down currently because not only are is down currently because not only are is down currently because not only are the environment variables compromised, the environment variables compromised, the environment variables compromised, they also took down deployments. So I've they also took down deployments. So I've they also took down deployments. So I've been unable to redeploy with the new been unable to redeploy with the new been unable to redeploy with the new environment variables after rolling environment variables after rolling environment variables after rolling them. So Railway had their environment them. So Railway had their environment them. So Railway had their environment variables stolen and their deployments variables stolen and their deployments variables stolen and their deployments taken off entirely. Open code just had taken off entirely. Open code just had taken off entirely. Open code just had the environment variable stolen. What is the environment variable stolen. What is the environment variable stolen. What is going on here? Well, I'm going to do going on here? Well, I'm going to do going on here? Well, I'm going to do another one of these split in half another one of these split in half another one of these split in half things because the railway thing is two things because the railway thing is two things because the railway thing is two separate pieces. You have the API keys separate pieces. You have the API keys separate pieces. You have the API keys that I mentioned before and open code that I mentioned before and open code that I mentioned before and open code also had those get stolen and railway also had those get stolen and railway also had those get stolen and railway separately has a full deployment outage.

separately has a full deployment outage. separately has a full deployment outage. The reason I'm separating these is I The reason I'm separating these is I The reason I'm separating these is I feel obligated to call out my sponsors feel obligated to call out my sponsors feel obligated to call out my sponsors when they're up to some [ __ ] The API when they're up to some [ __ ] The API when they're up to some [ __ ] The API key thing sucks, but this happens. This key thing sucks, but this happens. This key thing sucks, but this happens. This is like things get exploited. If you is like things get exploited. If you is like things get exploited. If you have sensitive data, people will target have sensitive data, people will target have sensitive data, people will target it. We'll talk more about what's going it. We'll talk more about what's going it. We'll talk more about what's going on there in a sec because I need to on there in a sec because I need to on there in a sec because I need to crash out a little about this side. I'm crash out a little about this side. I'm crash out a little about this side. I'm currently filming this video at 5:30 currently filming this video at 5:30 currently filming this video at 5:30 p.m. Deployments have been down on p.m. Deployments have been down on p.m. Deployments have been down on Railway since 1 a.m. It has been 16 Railway since 1 a.m. It has been 16 Railway since 1 a.m. It has been 16 hours since I could deploy to Railway. hours since I could deploy to Railway. hours since I could deploy to Railway. This is unrelated. This is not because This is unrelated. This is not because This is unrelated. This is not because Railway got hacked. The hack might have Railway got hacked. The hack might have Railway got hacked. The hack might have resulted in them doing things that resulted in them doing things that resulted in them doing things that caused this, but the inability to deploy caused this, but the inability to deploy caused this, but the inability to deploy and roll keys and fix your stuff on and roll keys and fix your stuff on and roll keys and fix your stuff on Railway is because Railway is Railway is because Railway is Railway is because Railway is incompetent. I would love for them to incompetent. I would love for them to incompetent. I would love for them to prove me wrong here, but I've been prove me wrong here, but I've been prove me wrong here, but I've been burned many a time and I am frustrated burned many a time and I am frustrated burned many a time and I am frustrated and I am annoyed and I will be and I am annoyed and I will be and I am annoyed and I will be reconsidering hosting important software reconsidering hosting important software reconsidering hosting important software on Railway in the future because sadly on Railway in the future because sadly on Railway in the future because sadly this is not the first time that their this is not the first time that their this is not the first time that their weird incompetence around how they weird incompetence around how they weird incompetence around how they manage their platform has burned me.

manage their platform has burned me. manage their platform has burned me. These comments are going to cost me tens These comments are going to cost me tens These comments are going to cost me tens of thousands of dollars because I have of thousands of dollars because I have of thousands of dollars because I have two pending ads with them. One of which two pending ads with them. One of which two pending ads with them. One of which I just recorded that I was actually I just recorded that I was actually I just recorded that I was actually quite excited about because I do love quite excited about because I do love quite excited about because I do love using the railway platform. It is using the railway platform. It is using the railway platform. It is absurdly good value. It is very well absurdly good value. It is very well absurdly good value. It is very well priced. The file storage S3 stuff that priced. The file storage S3 stuff that priced. The file storage S3 stuff that they do is incredible. One of the best they do is incredible. One of the best they do is incredible. One of the best blob stores there is. My agents love blob stores there is. My agents love blob stores there is. My agents love using it, too. This is inexcusable. If using it, too. This is inexcusable. If using it, too. This is inexcusable. If this was the first time it happened, this was the first time it happened, this was the first time it happened, that'd be one thing, but railway is that'd be one thing, but railway is that'd be one thing, but railway is consistently one of the most unstable consistently one of the most unstable consistently one of the most unstable parts of my infrastructure ecosystem. parts of my infrastructure ecosystem. parts of my infrastructure ecosystem. It's getting up there with GitHub at It's getting up there with GitHub at It's getting up there with GitHub at this point. And to those mentioning this point. And to those mentioning this point. And to those mentioning Fly.io, they were one of the few brands Fly.io, they were one of the few brands Fly.io, they were one of the few brands I cut off from sponsorships because I cut off from sponsorships because I cut off from sponsorships because their platform was so inconsistent, I their platform was so inconsistent, I their platform was so inconsistent, I couldn't even film ads without it couldn't even film ads without it couldn't even film ads without it crashing. So, I do not recommend Fly at crashing. So, I do not recommend Fly at crashing. So, I do not recommend Fly at all. I don't know what I recommend yet. all. I don't know what I recommend yet. all. I don't know what I recommend yet. I'll come back to y'all soon. You get I'll come back to y'all soon. You get I'll come back to y'all soon. You get the idea, though. The full deployment the idea, though. The full deployment the idea, though. The full deployment outage has very little to do with the outage has very little to do with the outage has very little to do with the hack and very much to do with Railway hack and very much to do with Railway hack and very much to do with Railway itself, which means the only remaining itself, which means the only remaining itself, which means the only remaining thing we have to talk about is the thing thing we have to talk about is the thing thing we have to talk about is the thing that actually matters here, the API that actually matters here, the API that actually matters here, the API keys. Why do people want these? keys. Why do people want these? keys. Why do people want these? especially if they can't keep using especially if they can't keep using especially if they can't keep using them. Like if I had two options them. Like if I had two options them. Like if I had two options personally, I could have an API key that personally, I could have an API key that personally, I could have an API key that worked for a day with unlimited usage or worked for a day with unlimited usage or worked for a day with unlimited usage or I had an API key that worked for a year I had an API key that worked for a year I had an API key that worked for a year with a $100 of usage a day. I'd pick the with a $100 of usage a day. I'd pick the with a $100 of usage a day. I'd pick the one for a year without question even for one for a year without question even for one for a year without question even for a month because I don't know what I a month because I don't know what I a month because I don't know what I personally would do with millions of personally would do with millions of personally would do with millions of dollars of inference in a given day.

dollars of inference in a given day. dollars of inference in a given day. Like I actually cannot fathom what I Like I actually cannot fathom what I Like I actually cannot fathom what I would do with that. And obviously once would do with that. And obviously once would do with that. And obviously once these keys start getting exploited, they these keys start getting exploited, they these keys start getting exploited, they are going to get rolled. they are going are going to get rolled. they are going are going to get rolled. they are going to stop working. The amount of time you to stop working. The amount of time you to stop working. The amount of time you get with one of these keys is relatively get with one of these keys is relatively get with one of these keys is relatively low. So who in the world would want low. So who in the world would want low. So who in the world would want unlimited inference for a few hours? unlimited inference for a few hours? unlimited inference for a few hours? Let's think about this. Who are the Let's think about this. Who are the Let's think about this. Who are the groups, the parties, the companies, the groups, the parties, the companies, the groups, the parties, the companies, the individuals who would want to get an individuals who would want to get an individuals who would want to get an anthropic API key and an open AI API key anthropic API key and an open AI API key anthropic API key and an open AI API key knowing that like they can only use it knowing that like they can only use it knowing that like they can only use it for so much time. I see people for so much time. I see people for so much time. I see people speculating that this is being used for speculating that this is being used for speculating that this is being used for scammers in order to do like generated scammers in order to do like generated scammers in order to do like generated responses to things. You can do that on responses to things. You can do that on responses to things. You can do that on cheap open weight models. It costs cheap open weight models. It costs cheap open weight models. It costs almost nothing. Not worth burning hacks almost nothing. Not worth burning hacks almost nothing. Not worth burning hacks like this. I see people saying hackers like this. I see people saying hackers like this. I see people saying hackers that want to use it to hack other that want to use it to hack other that want to use it to hack other things. I see people mentioning crypto things. I see people mentioning crypto things. I see people mentioning crypto for some reason, which is nonsense. for some reason, which is nonsense. for some reason, which is nonsense. There's only one reason you would want There's only one reason you would want There's only one reason you would want this. Say it with me, chat. this. Say it with me, chat. this. Say it with me, chat. Distillation. What the hell do I mean? Distillation. What the hell do I mean? Distillation. What the hell do I mean? Okay, hear me out. Let's say you're an Okay, hear me out. Let's say you're an Okay, hear me out. Let's say you're an AI lab that's trying to make a new AI lab that's trying to make a new AI lab that's trying to make a new really capable model. Let's come up with really capable model. Let's come up with really capable model. Let's come up with something entirely random. Let's say something entirely random. Let's say something entirely random. Let's say SED. You run this company called SEDDeek SED. You run this company called SEDDeek SED. You run this company called SEDDeek and you're trying to make the world's and you're trying to make the world's and you're trying to make the world's greatest models. As a researcher at greatest models. As a researcher at greatest models. As a researcher at SeepdeDeek, you want to use the best SeepdeDeek, you want to use the best SeepdeDeek, you want to use the best tools available to you. So, you go and tools available to you. So, you go and tools available to you. So, you go and register for we'll go with Denise. Okay, register for we'll go with Denise. Okay, register for we'll go with Denise. Okay, it's easier to just say Claude. I'm just it's easier to just say Claude. I'm just it's easier to just say Claude. I'm just saying Claude, [ __ ] it. So, you want to saying Claude, [ __ ] it. So, you want to saying Claude, [ __ ] it. So, you want to use the best-in-class models to help you use the best-in-class models to help you use the best-in-class models to help you with your work to get data to do all the

with your work to get data to do all the with your work to get data to do all the things that you want to do because your things that you want to do because your things that you want to do because your goal ultimately is to make a model goal ultimately is to make a model goal ultimately is to make a model similar in capability to what Enthropic similar in capability to what Enthropic similar in capability to what Enthropic puts out with Claude. Enthropic knows puts out with Claude. Enthropic knows puts out with Claude. Enthropic knows this. They know that the data that you this. They know that the data that you this. They know that the data that you can get from Claude is useful, not just can get from Claude is useful, not just can get from Claude is useful, not just for helping you write code to make your for helping you write code to make your for helping you write code to make your own models, but for generating the data own models, but for generating the data own models, but for generating the data that you can use to train the model. If that you can use to train the model. If that you can use to train the model. If you have enough examples of how Claude you have enough examples of how Claude you have enough examples of how Claude solves problems, you can do crazy solves problems, you can do crazy solves problems, you can do crazy things. Because the harsh reality is things. Because the harsh reality is things. Because the harsh reality is that the data that we trained models on that the data that we trained models on that the data that we trained models on is both hard to get now because the is both hard to get now because the is both hard to get now because the internet's been locked down and it's internet's been locked down and it's internet's been locked down and it's also not as valuable for things like also not as valuable for things like also not as valuable for things like coding with agents because there just coding with agents because there just coding with agents because there just aren't that many examples online or aren't that many examples online or aren't that many examples online or anywhere in the world of how an agent anywhere in the world of how an agent anywhere in the world of how an agent would solve a task when it starts to would solve a task when it starts to would solve a task when it starts to differ more from how humans do in differ more from how humans do in differ more from how humans do in particular when you start doing it particular when you start doing it particular when you start doing it inside of a bash terminal. Because of inside of a bash terminal. Because of inside of a bash terminal. Because of this data that shows how LLM handle this data that shows how LLM handle this data that shows how LLM handle complex tasks that they can do with the complex tasks that they can do with the complex tasks that they can do with the tools they have is incredibly useful tools they have is incredibly useful tools they have is incredibly useful data. But that data is not just stuff data. But that data is not just stuff data. But that data is not just stuff you can download from the internet. It's you can download from the internet. It's you can download from the internet. It's data that kind of needs to be data that kind of needs to be data that kind of needs to be manufactured. And this is why so many manufactured. And this is why so many manufactured. And this is why so many companies want to collect all of your companies want to collect all of your companies want to collect all of your history with claude and with OpenAI history with claude and with OpenAI history with claude and with OpenAI models because they can use that to models because they can use that to models because they can use that to refine and train new models with similar refine and train new models with similar refine and train new models with similar capabilities. This allows for companies capabilities. This allows for companies capabilities. This allows for companies that aren't anthropic and OpenAI to that aren't anthropic and OpenAI to that aren't anthropic and OpenAI to start to catch up faster to where start to catch up faster to where start to catch up faster to where anthropic and OpenAI are because they anthropic and OpenAI are because they anthropic and OpenAI are because they can use all of this data to train the can use all of this data to train the can use all of this data to train the model more effectively without having to model more effectively without having to model more effectively without having to build all the systems and environments build all the systems and environments build all the systems and environments that were used to make the data exist in that were used to make the data exist in that were used to make the data exist in the first place. Okay, with all of that the first place. Okay, with all of that the first place. Okay, with all of that said, why would they not just buy the said, why would they not just buy the said, why would they not just buy the tokens then? That's cuz when this goes tokens then? That's cuz when this goes tokens then? That's cuz when this goes the other way, they get banned. Not

the other way, they get banned. Not the other way, they get banned. Not allowed. Anthropic has went out of their allowed. Anthropic has went out of their allowed. Anthropic has went out of their way to ban all attempts from Chinese way to ban all attempts from Chinese way to ban all attempts from Chinese labs to try and collect enough data to labs to try and collect enough data to labs to try and collect enough data to distill. They've even banned companies distill. They've even banned companies distill. They've even banned companies in the US like they banned wind surf in the US like they banned wind surf in the US like they banned wind surf temporarily because they thought OpenAI temporarily because they thought OpenAI temporarily because they thought OpenAI was going to buy them because they don't was going to buy them because they don't was going to buy them because they don't want other companies getting access to want other companies getting access to want other companies getting access to their data to train a model with similar their data to train a model with similar their data to train a model with similar capabilities. They say because those capabilities. They say because those capabilities. They say because those capabilities won't have the same level capabilities won't have the same level capabilities won't have the same level of safety. I say it's a combination of of safety. I say it's a combination of of safety. I say it's a combination of that and also they're protecting their that and also they're protecting their that and also they're protecting their monopoly here. What this means is monopoly here. What this means is monopoly here. What this means is there's a lot of demand from companies there's a lot of demand from companies there's a lot of demand from companies like a hypothetical seepde here that like a hypothetical seepde here that like a hypothetical seepde here that want to use a lot of money to generate want to use a lot of money to generate want to use a lot of money to generate lots of claude tokens to get data they lots of claude tokens to get data they lots of claude tokens to get data they can use to train their models. But can use to train their models. But can use to train their models. But Claude is not willing to sell to them. Claude is not willing to sell to them. Claude is not willing to sell to them. Claude is not just unwilling to sell to Claude is not just unwilling to sell to Claude is not just unwilling to sell to seepde here. They're also more than seepde here. They're also more than seepde here. They're also more than willing to ban other companies that seem willing to ban other companies that seem willing to ban other companies that seem totally legit because they might be totally legit because they might be totally legit because they might be reselling the same data and tokens to reselling the same data and tokens to reselling the same data and tokens to seep. This includes a bunch of companies seep. This includes a bunch of companies seep. This includes a bunch of companies in South Korea that were paying in South Korea that were paying in South Korea that were paying Anthropic a ton of money. Some of which Anthropic a ton of money. Some of which Anthropic a ton of money. Some of which were even investors that Enthropic has were even investors that Enthropic has were even investors that Enthropic has chosen to cut off because they had chosen to cut off because they had chosen to cut off because they had reasons to believe that other Chinese reasons to believe that other Chinese reasons to believe that other Chinese labs were using those API keys to get labs were using those API keys to get labs were using those API keys to get the data they need for distillation. In the data they need for distillation. In the data they need for distillation. In order to prevent all of this, Anthropic order to prevent all of this, Anthropic order to prevent all of this, Anthropic has put a bunch of measures in place.

has put a bunch of measures in place. has put a bunch of measures in place. Obviously, they try to detect Obviously, they try to detect Obviously, they try to detect distillation, looking for certain distillation, looking for certain distillation, looking for certain archetypes and shapes of requests that archetypes and shapes of requests that archetypes and shapes of requests that are similar to when people are trying to are similar to when people are trying to are similar to when people are trying to distill. They also do some know your distill. They also do some know your distill. They also do some know your customer stuff to in certain cases try customer stuff to in certain cases try customer stuff to in certain cases try to get you to verify your identity with to get you to verify your identity with to get you to verify your identity with an ID card or your license, passport, an ID card or your license, passport, an ID card or your license, passport, something like that to make it less something like that to make it less something like that to make it less likely that you're a foreign national likely that you're a foreign national likely that you're a foreign national trying to steal data. They also have trying to steal data. They also have trying to steal data. They also have thresholds on how much API usage you can thresholds on how much API usage you can thresholds on how much API usage you can do until certain like levels of usage do until certain like levels of usage do until certain like levels of usage and age of account are hit. And there's and age of account are hit. And there's and age of account are hit. And there's a lot of things that can only be done on a lot of things that can only be done on a lot of things that can only be done on old accounts that can't be done on new old accounts that can't be done on new old accounts that can't be done on new accounts. And of course, they have hard accounts. And of course, they have hard accounts. And of course, they have hard bans on certain IPs and regions to make bans on certain IPs and regions to make bans on certain IPs and regions to make it harder for people in certain places it harder for people in certain places it harder for people in certain places like China to register for and use like China to register for and use like China to register for and use anthropics inference over anthropics anthropics inference over anthropics anthropics inference over anthropics APIs. What I'm trying to say here is APIs. What I'm trying to say here is APIs. What I'm trying to say here is seepde can't just go register for a seepde can't just go register for a seepde can't just go register for a cloud account and expect to have a whole cloud account and expect to have a whole cloud account and expect to have a whole lot of luck with it. But this is an lot of luck with it. But this is an lot of luck with it. But this is an opportunity for people in between. If opportunity for people in between. If opportunity for people in between. If you're a hacker, a dishonest person, or you're a hacker, a dishonest person, or you're a hacker, a dishonest person, or otherwise just want to get a bunch of otherwise just want to get a bunch of otherwise just want to get a bunch of money out of one of these labs, all you money out of one of these labs, all you money out of one of these labs, all you need is a bunch of cloud API keys. You need is a bunch of cloud API keys. You need is a bunch of cloud API keys. You don't even need credit cards. You don't don't even need credit cards. You don't don't even need credit cards. You don't even need to forge identities. All you even need to forge identities. All you even need to forge identities. All you need is these API keys people have made need is these API keys people have made need is these API keys people have made on Claude and forgotten about because on Claude and forgotten about because on Claude and forgotten about because once you have those, you now have once you have those, you now have once you have those, you now have everything you need to generate a bunch everything you need to generate a bunch everything you need to generate a bunch of tokens. It will get banned obviously, of tokens. It will get banned obviously, of tokens. It will get banned obviously, but you can get a lot in before that but you can get a lot in before that but you can get a lot in before that happens and you don't have to pay a happens and you don't have to pay a happens and you don't have to pay a scent because it's somebody else's scent because it's somebody else's scent because it's somebody else's billing, somebody else's account. As billing, somebody else's account. As billing, somebody else's account. As such, there is a ton of demand for such, there is a ton of demand for such, there is a ton of demand for clawed API keys, for OpenAI API keys, clawed API keys, for OpenAI API keys, clawed API keys, for OpenAI API keys, things that people have on accounts that things that people have on accounts that things that people have on accounts that they are not monitoring very well. And they are not monitoring very well. And they are not monitoring very well. And I'll be real, I don't monitor our OpenAI

I'll be real, I don't monitor our OpenAI I'll be real, I don't monitor our OpenAI spend particularly well. I was very spend particularly well. I was very spend particularly well. I was very nervous today when Railway got pawned, nervous today when Railway got pawned, nervous today when Railway got pawned, looking to make sure none of my accounts looking to make sure none of my accounts looking to make sure none of my accounts were getting hit because I just haven't were getting hit because I just haven't were getting hit because I just haven't had to check in a while. This is because had to check in a while. This is because had to check in a while. This is because the Chinese labs and other parties that the Chinese labs and other parties that the Chinese labs and other parties that want to make smarter models but are want to make smarter models but are want to make smarter models but are banned from anthropic and open AI need banned from anthropic and open AI need banned from anthropic and open AI need ways to get the tokens in order to ways to get the tokens in order to ways to get the tokens in order to distill their models. And I'm going to distill their models. And I'm going to distill their models. And I'm going to stop pretending that this isn't stop pretending that this isn't stop pretending that this isn't happening. It very obviously is. All of happening. It very obviously is. All of happening. It very obviously is. All of the Chinese labs are trying incredibly the Chinese labs are trying incredibly the Chinese labs are trying incredibly hard to get all the possible data they hard to get all the possible data they hard to get all the possible data they can to make their models act similar to can to make their models act similar to can to make their models act similar to Quad. This is one of those attempts. Quad. This is one of those attempts. Quad. This is one of those attempts. Since Anthropic is not willing to sell Since Anthropic is not willing to sell Since Anthropic is not willing to sell inference to these companies that want inference to these companies that want inference to these companies that want these tokens for a reason that we can these tokens for a reason that we can these tokens for a reason that we can argue the validity in all we want, argue the validity in all we want, argue the validity in all we want, Anthropic's desire to not let them get Anthropic's desire to not let them get Anthropic's desire to not let them get those tokens and not let them have that those tokens and not let them have that those tokens and not let them have that inference is causing a weird downstream inference is causing a weird downstream inference is causing a weird downstream effect where users, customers, builders effect where users, customers, builders effect where users, customers, builders like railway, open code, and more are like railway, open code, and more are like railway, open code, and more are now targets in ways they've never been now targets in ways they've never been now targets in ways they've never been before. Honing railway honestly doesn't before. Honing railway honestly doesn't before. Honing railway honestly doesn't get you a whole lot, especially if it get you a whole lot, especially if it get you a whole lot, especially if it happened before the AI era. everybody happened before the AI era. everybody happened before the AI era. everybody was hosting these keys on their railway was hosting these keys on their railway was hosting these keys on their railway deployments because generally if you get deployments because generally if you get deployments because generally if you get into everyone's databases by the time into everyone's databases by the time into everyone's databases by the time you've dumped enough data to even you've dumped enough data to even you've dumped enough data to even vaguely be useful, you've been locked vaguely be useful, you've been locked vaguely be useful, you've been locked out and how useful is that data? Good out and how useful is that data? Good out and how useful is that data? Good luck figuring out. But if you get a luck figuring out. But if you get a luck figuring out. But if you get a bunch of passwords that can be used to bunch of passwords that can be used to bunch of passwords that can be used to generate between a hundred and a few generate between a hundred and a few generate between a hundred and a few thousand dollars of value before they're thousand dollars of value before they're thousand dollars of value before they're killed and then you resell those for killed and then you resell those for killed and then you resell those for cheap to companies that want to do cheap to companies that want to do cheap to companies that want to do sketchy things with it, that is a huge sketchy things with it, that is a huge sketchy things with it, that is a huge opportunity. What I'm trying to say is opportunity. What I'm trying to say is opportunity. What I'm trying to say is every platform that hosts API keys is a every platform that hosts API keys is a every platform that hosts API keys is a target now because there is so much target now because there is so much target now because there is so much demand in these sketchy black markets

demand in these sketchy black markets demand in these sketchy black markets for anthropic and open AI API keys. I for anthropic and open AI API keys. I for anthropic and open AI API keys. I would say Gemini, but I'll be real. I would say Gemini, but I'll be real. I would say Gemini, but I'll be real. I don't think anyone's trying to distill don't think anyone's trying to distill don't think anyone's trying to distill Gemini right now, even Google. You get Gemini right now, even Google. You get Gemini right now, even Google. You get the idea, though. Everything is kind of the idea, though. Everything is kind of the idea, though. Everything is kind of [ __ ] [ __ ] [ __ ] I have a bad feeling it's going to get a I have a bad feeling it's going to get a I have a bad feeling it's going to get a lot worse before it gets better. It's lot worse before it gets better. It's lot worse before it gets better. It's weird to frame it as Anthropic's weird to frame it as Anthropic's weird to frame it as Anthropic's unwillingness to sell to these companies unwillingness to sell to these companies unwillingness to sell to these companies is getting other companies pawned in the is getting other companies pawned in the is getting other companies pawned in the middle, but that's effectively what's middle, but that's effectively what's middle, but that's effectively what's happening. A lot of us are going to get happening. A lot of us are going to get happening. A lot of us are going to get caught in the crossfire here. Whether or caught in the crossfire here. Whether or caught in the crossfire here. Whether or not Anthropic is doing the right thing not Anthropic is doing the right thing not Anthropic is doing the right thing is up for debate. I think it is their is up for debate. I think it is their is up for debate. I think it is their right as a company to choose who they do right as a company to choose who they do right as a company to choose who they do and don't want to sell to. It is just a and don't want to sell to. It is just a and don't want to sell to. It is just a very painful, strange, and arguably very painful, strange, and arguably very painful, strange, and arguably hellish side effect that we are now hellish side effect that we are now hellish side effect that we are now getting pawned in the ways we are getting pawned in the ways we are getting pawned in the ways we are because of the demand for those keys. because of the demand for those keys. because of the demand for those keys. And on top of all of this, we can't use And on top of all of this, we can't use And on top of all of this, we can't use the models from Open Anthropic to figure the models from Open Anthropic to figure the models from Open Anthropic to figure out what's wrong and fix it because out what's wrong and fix it because out what's wrong and fix it because they'll start refusing because they they'll start refusing because they they'll start refusing because they think we might be the hackers. So once think we might be the hackers. So once think we might be the hackers. So once again, Open Anthropic have put us in again, Open Anthropic have put us in again, Open Anthropic have put us in this position and aren't really here to this position and aren't really here to this position and aren't really here to help us. It's going to be bad and it's help us. It's going to be bad and it's help us. It's going to be bad and it's not going to get better. It's going to not going to get better. It's going to not going to get better. It's going to get a lot worse first. I said 6 months get a lot worse first. I said 6 months get a lot worse first. I said 6 months ago in a podcast that we had 3 to nine ago in a podcast that we had 3 to nine ago in a podcast that we had 3 to nine months. Weird how spot on I was.

months. Weird how spot on I was. months. Weird how spot on I was. Okay, actual last thing because I Okay, actual last thing because I Okay, actual last thing because I already foresee the comments and I already foresee the comments and I already foresee the comments and I probably should have mentioned this probably should have mentioned this probably should have mentioned this earlier because the type of people who earlier because the type of people who earlier because the type of people who leave these comments don't watch the leave these comments don't watch the leave these comments don't watch the whole video. If you think the PHP hack whole video. If you think the PHP hack whole video. If you think the PHP hack and the railway or open code hacks are and the railway or open code hacks are and the railway or open code hacks are related, I hope that you aren't too tied related, I hope that you aren't too tied related, I hope that you aren't too tied to this software dev thing because to this software dev thing because to this software dev thing because you're going to be replaced by Claude you're going to be replaced by Claude you're going to be replaced by Claude very, very soon. It is so very obvious very, very soon. It is so very obvious very, very soon. It is so very obvious these things have nothing to do with these things have nothing to do with these things have nothing to do with each other and I have nothing else to each other and I have nothing else to each other and I have nothing else to say about it. It does feel like the say about it. It does feel like the say about it. It does feel like the start of the end, so I guess there's no start of the end, so I guess there's no start of the end, so I guess there's no better time to end the video, right? better time to end the video, right? better time to end the video, right? Seriously, protect your [ __ ] Keep Seriously, protect your [ __ ] Keep Seriously, protect your [ __ ] Keep everything up to date. Keep an eye everything up to date. Keep an eye everything up to date. Keep an eye online to see where things are online to see where things are online to see where things are happening. And make sure your API keys happening. And make sure your API keys happening. And make sure your API keys are very well protected, very well are very well protected, very well are very well protected, very well separated, and easy to revoke because separated, and easy to revoke because separated, and easy to revoke because this is going to get a hell of a lot this is going to get a hell of a lot this is going to get a hell of a lot worse before it gets better. I think worse before it gets better. I think worse before it gets better. I think that's all I have to say. So until next that's all I have to say. So until next that's all I have to say. So until next time, he's nerds.