According to Funk Podcast & Blog

Format	size	Download
MP3 Audio	26 MB	Download
AAC m4a	13 MB	Download

transcript
00:00 - 0:00:05 In this issue I will deal with it a bit and a few thoughts
0:00:05 – 0:00:08 to IT security.
0:00:08 – 0:00:17 Because the 20th of October showed us all how vulnerable and vulnerable our infrastructure is.
0:00:17 – 0:00:19 is in the whole.
0:00:19 – 0:00:22 [Music]
0:00:22 – 0:00:52 [Music]
0:00:52 – 0:00:59 Yes, hello and welcome to a new episode of digression where I occasionally, actually
0:00:59 – 0:01:06 never, but I've made it my intention to digress in every episode. I am Sasha
0:01:06 – 0:01:14 Machmann and say hello. I had given myself a few thoughts in the course of a security gap,
0:01:14 – 0:01:29 which was announced on October 20th and - let me not lie - made big waves on the 21st
0:01:29 – 0:01:39 has. Because I had been so a bit on the road between household and the usual
0:01:39 – 0:01:45 Things I do like that and then I went on Mastodon. This is so almost my
0:01:45 – 0:01:50 Favorite short message service of my choice. And then I saw that my
0:01:50 – 0:01:58 Internet provider, no not Internet provider, my hosting provider issued a message
0:01:58 – 0:02:05 had that he now, as a precaution, provided a special service that my software,
0:02:05 – 0:02:13 which provides my website, have switched off. And then I looked at why,
0:02:13 – 0:02:23 Why, why and have seen, there is a huge problem. For it had not been so,
0:02:23 – 0:02:31 that the software for my website, which is WordPress, had an error. I mean,
0:02:31 – 0:02:35 There are always errors, but they are fixed relatively quickly.
0:02:35 – 0:02:43 But it was on the server side, because the programming language PHP,
0:02:43 – 0:02:51 on which is based a variety of software out there on the Internet,
0:02:51 – 0:03:00 CMS like WordPress, Drupal, Nextcloud and so on are all based on PHP.
0:03:00 – 0:03:07 There was a massive security flaw. The interesting thing is, this security flaw is
0:03:07 – 0:03:16 known for ages. eternity. I think the first time that somehow was mentioned in 2014
0:03:16 – 0:03:24 And it has always dragged through like that. In any case, the PAP team reacted relatively quickly
0:03:24 – 0:03:36 and had in the early afternoon of 21.10. Patches provided and so could my
0:03:36 – 0:03:46 Hosting providers install the new patches and thus the problem was solved first.
0:03:46 – 0:03:58 So much for that. So if anyone was wondering why the podcast, the website and so on
0:03:58 – 0:04:07 21.10. so from about noon to early afternoon was offline, that's the explanation.
0:04:07 – 0:04:13 What is really interesting and also so striking is actually,
0:04:13 – 0:04:26 How vulnerable our infrastructure is. Yeah, great if you take a shot and call someone.
0:04:26 – 0:04:40 We were at the vulnerability of the infrastructure. Because a software provider would have to do the case yes
0:04:40 – 0:04:46 only if there is an error, adapt the software. And then would also be quasi
0:04:46 – 0:04:54 Only this product is affected. But since this gap was almost at the server level, it simply affected
0:04:54 – 0:05:04 a variety of services and yesterday on the 23rd not all services were online yet. At least
0:05:04 – 0:05:11 the surfaces of it. The services worked, but the surfaces were halt
0:05:11 – 0:05:19 unreachable. Because I think that there just on server side the patches not yet
0:05:19 – 0:05:44 were made. Because older visions than PAP 8.2 were not taken into account and actually
0:05:44 – 0:05:51 Very quickly only the 4 and the 5 were patched. The others just have a little longer
0:05:51 – 0:05:57 lasted. And older versions are not taken into account at all. First of all, you have to look at
0:05:57 – 0:06:04 Let the tongue melt. I also know this from some people from my circle of acquaintances,
0:06:04 – 0:06:11 Circle that even let things run under 7.4, 4.7.
0:06:11 – 0:06:19 Ne, 7.4, but 7.4 have run because simply the software does not evolve
0:06:19 – 0:06:30 and because after that there were always such changes in the PAP, yes, in the PAP substructure, in order to
0:06:30 – 0:06:37 To explain this quite simply and loosely, which had made it impossible to understand the visions.
0:06:37 – 0:06:44 update because certain functions have ceased to exist or functions accessed by the Software
0:06:44 – 0:06:51 has been changed in such a way that the software could not cope with it. And if there are then no updates
0:06:51 – 0:06:57 given for the software, you could not bring the substructure up to date.
0:06:57 – 0:07:05 And I think that's a big problem right now and either you take the risk,
0:07:05 – 0:07:13 that this gap is exploited or you have to wait until there are updates for the software.
0:07:13 – 0:07:21 Yes, I am glad that I use software that is being further developed and
0:07:21 – 0:07:33 it is looked at that halt the latest things are supported and how I now halt looked
0:07:33 – 0:07:40 have, with me on the server, the updates were recorded and there was also the latest
0:07:40 – 0:07:48 Version of PHP, the 8.5. That's when I thought I'd try what would happen if you
0:07:48 – 0:07:58 From four to five changes. And I have to say, interestingly, parts of the website are
0:07:58 – 0:08:04 faster now. Before, this has always felt eternities lasted, so determines five,
0:08:04 – 0:08:10 six seconds until the player is loaded for the podcast on the website. Now this is
0:08:10 – 0:08:16 Twice as fast, maybe two seconds. And I think so, that's beautiful,
0:08:16 – 0:08:26 Because there are often optimizations in the code for newer versions, where this is easy
0:08:26 – 0:08:29 is played faster or executed faster.
0:08:29 – 0:08:36 And I'm really glad that there are the developers for the plugins, the keep in the WordPress in it
0:08:36 – 0:08:41 are who also provide the podcast, all this always to a very up-to-date state
0:08:41 – 0:08:49 And even if they always say yes, we're not 100% sure if that's the case.
0:08:49 – 0:08:54 Everything works, because there are different constellations with the whole plugins, which
0:08:54 – 0:09:03 you can install for WordPress, so quasi extensions, whether all this together
0:09:03 – 0:09:04 It works.
0:09:04 – 0:09:12 They never give a guarantee, but if I try it, it runs to 99% always.
0:09:12 – 0:09:18 And now the tests I did show that the site is simply much faster.
0:09:18 – 0:09:28 I mean, I have a cache in it that keeps these PHP features being used over and over again,
0:09:28 – 0:09:33 caches, so that this does not have to be recalculated every time the
0:09:33 – 0:09:39 certain content that the site simply needs to function, i.e. from the
0:09:33 – 0:09:39 certain content that the site simply needs to function, i.e. from the
0:09:39 – 0:09:44 Database, also cached, so it simply loads faster because
0:09:39 – 0:09:44 Database, also cached, so it simply loads faster because
0:09:44 – 0:09:49 this memory is in the memory of the server and therefore natural
0:09:44 – 0:09:49 this memory is in the memory of the server and therefore natural
0:09:49 – 0:09:53 improbably fast. I don't want to go into so much detail now
0:09:49 – 0:09:53 improbably fast. I don't want to go into so much detail now
0:09:53 – 0:10:00 go and also use any technical terms for it. I don't want that now because someone,
0:09:53 – 0:10:00 go and also use any technical terms for it. I don't want that now because someone,
0:10:00 – 0:10:05 who is not interested in it now, he will then simply use thousands of terms
0:10:00 – 0:10:05 who is not interested in it now, he will then simply use thousands of terms
0:10:05 – 0:10:14 slain. But such a RADIUS server and cache, which is already really awesome, because you really
0:10:05 – 0:10:14 slain. But such a RADIUS server and cache, which is already really awesome, because you really
0:10:14 – 0:10:22 can easily cache many functions that are often needed. And not every time out
0:10:14 – 0:10:22 can easily cache many functions that are often needed. And not every time out
0:10:22 – 0:10:28 the database or from the code must be loaded, then executed, but the code is fixed and ready
0:10:22 – 0:10:28 the database or from the code must be loaded, then executed, but the code is fixed and ready
0:10:28 – 0:10:36 Hold inside this cache and can be read out very quickly and then used. Yes, I am
0:10:28 – 0:10:36 Hold inside this cache and can be read out very quickly and then used. Yes, I am
0:10:36 – 0:10:44 I'm just glad I bet on the right horses without knowing it. This is
0:10:36 – 0:10:44 I'm just glad I bet on the right horses without knowing it. This is
0:10:44 – 0:10:51 very important, that was not a decision, yes they are all future-proof, but I have
0:10:44 – 0:10:51 very important, that was not a decision, yes they are all future-proof, but I have
0:10:51 – 0:10:57 this function is in connection with my provider, who must also do this on the server side
0:10:51 – 0:10:57 this function is in connection with my provider, who must also do this on the server side
0:10:57 – 0:11:03 provide, had been picked out with me because I thought so, this is proven technology,
0:10:57 – 0:11:03 provide, had been picked out with me because I thought so, this is proven technology,
0:11:03 – 0:11:11 which is used en masse in the, yes in the professional use, then you also try it out
0:11:03 – 0:11:11 which is used en masse in the, yes in the professional use, then you also try it out
0:11:11 – 0:11:16 and I think that was the right decision, because I now have a page with the new
0:11:11 – 0:11:16 and I think that was the right decision, because I now have a page with the new
0:11:16 – 0:11:23 Version of PHP is simply faster.
0:11:16 – 0:11:23 Version of PHP is simply faster.
0:11:23 – 0:11:26 Not as fast as when I
0:11:23 – 0:11:26 Not as fast as when I
0:11:26 – 0:11:29 would now make a static page, so
0:11:26 – 0:11:29 would now make a static page, so
0:11:29 – 0:11:32 a page that has a fixed code and then
0:11:29 – 0:11:32 a page that has a fixed code and then
0:11:32 – 0:11:34 is executed, but I have a
0:11:32 – 0:11:34 is executed, but I have a
0:11:34 – 0:11:36 the dynamic side. When I get new
0:11:34 – 0:11:36 the dynamic side. When I get new
0:11:36 – 0:11:39 texts, a new blog post and so on
0:11:36 – 0:11:39 texts, a new blog post and so on
0:11:39 – 0:11:42 insert, then the stop will not be in
0:11:39 – 0:11:42 insert, then the stop will not be in
0:11:42 – 0:11:44 Code stored on the page, but in
0:11:42 – 0:11:48 a database and all these retrievals from the database always takes time and the
0:11:42 – 0:11:44 Code stored on the page, but in
0:11:42 – 0:11:48 a database and all these retrievals from the database always takes time and the
0:11:48 – 0:11:56 makes the page noticeably slower, but I have the greatest possible freedom,
0:11:48 – 0:11:56 makes the page noticeably slower, but I have the greatest possible freedom,
0:11:56 – 0:12:04 In terms of design, in terms of content. I can compensate a lot by a normal
0:11:56 – 0:12:04 In terms of design, in terms of content. I can compensate a lot by a normal
0:12:04 – 0:12:10 Cache, which almost always saves an image as a static page and always saves it
0:12:04 – 0:12:10 Cache, which almost always saves an image as a static page and always saves it
0:12:10 – 0:12:17 delivered again, because if you think about it, I don't load new content every 15 minutes
0:12:10 – 0:12:17 delivered again, because if you think about it, I don't load new content every 15 minutes
0:12:17 – 0:12:25 up. This is with me sometimes only once a week, rarely that I stop two or
0:12:17 – 0:12:25 up. This is with me sometimes only once a week, rarely that I stop two or
0:12:25 – 0:12:33 three times what do and so there are then insane speed advantages, because stop
0:12:25 – 0:12:33 three times what do and so there are then insane speed advantages, because stop
0:12:33 – 0:12:40 interlock this whole cache and virtually support each other,
0:12:33 – 0:12:40 interlock this whole cache and virtually support each other,
0:12:40 – 0:12:47 accelerating. You know what I mean? Yes, that was a short discourse in
0:12:40 – 0:12:47 accelerating. You know what I mean? Yes, that was a short discourse in
0:12:47 – 0:12:57 WordPress, infrastructure, obliques. How do I get the side that this is faster
0:12:47 – 0:12:57 WordPress, infrastructure, obliques. How do I get the side that this is faster
0:12:57 – 0:13:00 is delivered without me putting a super fast server there?
0:12:57 – 0:13:00 is delivered without me putting a super fast server there?
0:13:00 – 0:13:12 On the whole, I would say that this incident has shown that we have two points of speech.
0:13:00 – 0:13:12 On the whole, I would say that this incident has shown that we have two points of speech.
0:13:12 – 0:13:20 I mean that the software, like WordPress or something, always has some gaps
0:13:12 – 0:13:20 I mean that the software, like WordPress or something, always has some gaps
0:13:20 – 0:13:30 can. This is well known and everyone expects it. But that it stops on server side with the
0:13:20 – 0:13:30 can. This is well known and everyone expects it. But that it stops on server side with the
0:13:30 – 0:13:36 Provision of services gave rise to such problems and that is above all a problem, which so many
0:13:30 – 0:13:36 Provision of services gave rise to such problems and that is above all a problem, which so many
0:13:36 – 0:13:43 Pages are concerned. When I consider alone that about 50 percent of websites on the Internet
0:13:36 – 0:13:43 Pages are concerned. When I consider alone that about 50 percent of websites on the Internet
0:13:43 – 0:13:52 at least based on WordPress, even if these are quasi static pages, because they are not
0:13:43 – 0:13:52 at least based on WordPress, even if these are quasi static pages, because they are not
0:13:52 – 0:14:02 have changeable content, so such a one-pager or something, then that's all the more threatening,
0:13:52 – 0:14:02 have changeable content, so such a one-pager or something, then that's all the more threatening,
0:14:02 – 0:14:08 if you then have to switch off a protocol for security reasons and then quasi
0:14:02 – 0:14:08 if you then have to switch off a protocol for security reasons and then quasi
0:14:08 – 0:14:15 the whole pages all no longer work because half PHP was switched off what needed
0:14:08 – 0:14:15 the whole pages all no longer work because half PHP was switched off what needed
0:14:15 – 0:14:20 so that the pages work at all, so that they can be displayed at all.
0:14:15 – 0:14:20 so that the pages work at all, so that they can be displayed at all.
0:14:20 – 0:14:28 And of course other things. I mean, on the train, ads failed,
0:14:20 – 0:14:28 And of course other things. I mean, on the train, ads failed,
0:14:28 – 0:14:36 because it guarantees itself also via PHP somehow somewhere from a database or so stays
0:14:28 – 0:14:36 because it guarantees itself also via PHP somehow somewhere from a database or so stays
0:14:36 – 0:14:44 have pulled the data, these ads should. You just have to expect that such
0:14:36 – 0:14:44 have pulled the data, these ads should. You just have to expect that such
0:14:44 – 0:14:48 gaps can occur again and again and above all now in the current time,
0:14:44 – 0:14:48 gaps can occur again and again and above all now in the current time,
0:14:48 – 0:14:54 where we have AI that can easily search software much faster and much faster
0:14:48 – 0:14:54 where we have AI that can easily search software much faster and much faster
0:14:54 – 0:15:01 You can find any weak points. I don't know if you've noticed why
0:14:54 – 0:15:01 You can find any weak points. I don't know if you've noticed why
0:15:01 – 0:15:13 Anthropic the Fable model came out because before it there was a model that was way too strong,
0:15:01 – 0:15:13 Anthropic the Fable model came out because before it there was a model that was way too strong,
0:15:13 – 0:15:25 Need 5 and that cyber security has offered such blatant attack vectors that you can
0:15:13 – 0:15:25 Need 5 and that cyber security has offered such blatant attack vectors that you can
0:15:25 – 0:15:31 kept under wraps for the first time and published a stripped-down version out
0:15:25 – 0:15:31 kept under wraps for the first time and published a stripped-down version out
0:15:31 – 0:15:38 and very few people have access to this extremely powerful software because they were afraid
0:15:31 – 0:15:38 and very few people have access to this extremely powerful software because they were afraid
0:15:38 – 0:15:42 that it is used en masse to find vulnerabilities in software,
0:15:38 – 0:15:42 that it is used en masse to find vulnerabilities in software,
0:15:42 – 0:15:53 They are found and then exploited. Yes, these things find such
0:15:42 – 0:15:53 They are found and then exploited. Yes, these things find such
0:15:53 – 0:16:01 weak points. And that was the case in this case. A young programmer had this
0:15:53 – 0:16:01 weak points. And that was the case in this case. A young programmer had this
0:16:01 – 0:16:07 found. The interesting thing is, that's what I said at the beginning that this position has been around since
0:16:01 – 0:16:07 found. The interesting thing is, that's what I said at the beginning that this position has been around since
0:16:07 – 0:16:18 2014 is known, because this code, which was so vulnerable, was already introduced in PRP and
0:16:07 – 0:16:18 2014 is known, because this code, which was so vulnerable, was already introduced in PRP and
0:16:18 – 0:16:26 You never fixed that because you would have had to change too much about the software, but not about the software.
0:16:18 – 0:16:26 You never fixed that because you would have had to change too much about the software, but not about the software.
0:16:26 – 0:16:33 On the server side, but on the software that used this service PRP. And you just have that
0:16:26 – 0:16:33 On the server side, but on the software that used this service PRP. And you just have that
0:16:33 – 0:16:39 Not done for cost reasons. And now this has almost fallen to one's feet,
0:16:33 – 0:16:39 Not done for cost reasons. And now this has almost fallen to one's feet,
0:16:39 – 0:16:45 because I think it was Amazon, had a day before a big attack just about this gap
0:16:39 – 0:16:45 because I think it was Amazon, had a day before a big attack just about this gap
0:16:45 – 0:16:51 – and I don’t want to explain how it worked now – but it had to do with it
0:16:45 – 0:16:51 – and I don’t want to explain how it worked now – but it had to do with it
0:16:51 – 0:17:01 had that since in this PRP protocol, in this processing, memory was not properly managed
0:16:51 – 0:17:01 had that since in this PRP protocol, in this processing, memory was not properly managed
0:17:01 – 0:17:10 and that it was possible to read certain small shreds from the outside. And with that one came to the
0:17:01 – 0:17:10 and that it was possible to read certain small shreds from the outside. And with that one came to the
0:17:10 – 0:17:16 Key to breaking into Amazon's large infrastructure. That it was a day before
0:17:10 – 0:17:16 Key to breaking into Amazon's large infrastructure. That it was a day before
0:17:16 – 0:17:23 Announcing this vulnerability happens. Who knows how many systems have already cracked and
0:17:16 – 0:17:23 Announcing this vulnerability happens. Who knows how many systems have already cracked and
0:17:23 – 0:17:30 where it was invaded, without this being virtually announced, because it was not noticed,
0:17:23 – 0:17:30 where it was invaded, without this being virtually announced, because it was not noticed,
0:17:30 – 0:17:32 Because there was this security flaw.
0:17:30 – 0:17:32 Because there was this security flaw.
0:17:32 – 0:17:38 Well, that just shows,
0:17:32 – 0:17:38 Well, that just shows,
0:17:38 – 0:17:40 We just have to think a lot more.
0:17:38 – 0:17:40 We just have to think a lot more.
0:17:40 – 0:17:42 And what is also important,
0:17:40 – 0:17:42 And what is also important,
0:17:42 – 0:17:45 Always feel the update.
0:17:42 – 0:17:45 Always feel the update.
0:17:45 – 0:17:48 Thank God I have a hosting provider.
0:17:45 – 0:17:48 Thank God I have a hosting provider.
0:17:48 – 0:17:50 This is Uberspace.
0:17:48 – 0:17:50 This is Uberspace.
0:17:50 – 0:17:53 They are all extremely nerds.
0:17:50 – 0:17:53 They are all extremely nerds.
0:17:53 – 0:17:55 Some are also active members.
0:17:53 – 0:17:55 Some are also active members.
0:17:55 – 0:17:57 the Chaos Computer Club.
0:17:55 – 0:17:57 the Chaos Computer Club.
0:17:57 – 0:18:08 I also stay there in the fields and am even active in the Dortmund Chaos Computer Club
0:17:57 – 0:18:08 I also stay there in the fields and am even active in the Dortmund Chaos Computer Club
0:18:08 – 0:18:21 And also know some people about it. Yes, I can only be glad that these people are all such nerds
0:18:08 – 0:18:21 And also know some people about it. Yes, I can only be glad that these people are all such nerds
0:18:21 – 0:18:28 are and are concerned about safety, which are then very fast and very active,
0:18:21 – 0:18:28 are and are concerned about safety, which are then very fast and very active,
0:18:28 – 0:18:36 Just install these updates and patches without having to worry about it. I mean,
0:18:28 – 0:18:36 Just install these updates and patches without having to worry about it. I mean,
0:18:36 – 0:18:40 I was just thinking, try it out. I've seen that the latest version is here,
0:18:36 – 0:18:40 I was just thinking, try it out. I've seen that the latest version is here,
0:18:40 – 0:18:48 So not 4, but 8.5 and then I saw that my side is running faster,
0:18:40 – 0:18:48 So not 4, but 8.5 and then I saw that my side is running faster,
0:18:48 – 0:18:54 I'm profiting. But I don't need to worry about updates and patches now,
0:18:48 – 0:18:54 I'm profiting. But I don't need to worry about updates and patches now,
0:18:54 – 0:18:58 Because that's what my provider does. Once there is one and it is proven to be stable,
0:18:54 – 0:18:58 Because that's what my provider does. Once there is one and it is proven to be stable,
0:18:58 – 0:19:08 if it is recorded and zack, I have then almost there a version without previously known
0:18:58 – 0:19:08 if it is recorded and zack, I have then almost there a version without previously known
0:19:08 – 0:19:14 Vulnerabilities. And here we come to a certain point. I just said without
0:19:08 – 0:19:14 Vulnerabilities. And here we come to a certain point. I just said without
0:19:14 – 0:19:20 acquaintances. This does not mean that this version that is currently in use does not have a security vulnerability.
0:19:14 – 0:19:20 acquaintances. This does not mean that this version that is currently in use does not have a security vulnerability.
0:19:20 – 0:19:31 She just isn't known yet. Published. Well, I had with the last problems what I
0:19:20 – 0:19:31 She just isn't known yet. Published. Well, I had with the last problems what I
0:19:31 – 0:19:41 This concerned the plugin that provides the podcast. The Word, from WordPress, it was
0:19:31 – 0:19:41 This concerned the plugin that provides the podcast. The Word, from WordPress, it was
0:19:41 – 0:19:51 no problem at all, but it was a problem of the Potlov Publisher and that there are pictures wrong
0:19:41 – 0:19:51 no problem at all, but it was a problem of the Potlov Publisher and that there are pictures wrong
0:19:51 – 0:19:57 was cached and you could inject program code because you were in this cache
0:19:51 – 0:19:57 was cached and you could inject program code because you were in this cache
0:19:57 – 0:20:04 could write in. And so my side was infected once and I also had a
0:19:57 – 0:20:04 could write in. And so my side was infected once and I also had a
0:20:04 – 0:20:11 I did a blog post and I did a podcast episode as well. Yes, so no matter how far
0:20:04 – 0:20:11 I did a blog post and I did a podcast episode as well. Yes, so no matter how far
0:20:11 – 0:20:17 one thinks ahead and one thinks one is sure there will always be such problems and there will be
0:20:11 – 0:20:17 one thinks ahead and one thinks one is sure there will always be such problems and there will be
0:20:17 – 0:20:24 There will always be such failures and you just have to reckon with that. And if we
0:20:17 – 0:20:24 There will always be such failures and you just have to reckon with that. And if we
0:20:24 – 0:20:31 this artificial intelligence, which is now detecting these problems and vulnerabilities, and
0:20:24 – 0:20:31 this artificial intelligence, which is now detecting these problems and vulnerabilities, and
0:20:31 – 0:20:43 makes visible, helps to solve these problems, this can also become a danger if everyone
0:20:31 – 0:20:43 makes visible, helps to solve these problems, this can also become a danger if everyone
0:20:43 – 0:20:50 Strong models can use and not everyone does it in the best of intentions. The way I stop
0:20:43 – 0:20:50 Strong models can use and not everyone does it in the best of intentions. The way I stop
0:20:50 – 0:20:59 can go with a good model, write a nice piece of software, what you then "Vipe
0:20:50 – 0:20:59 can go with a good model, write a nice piece of software, what you then "Vipe
0:20:59 – 0:21:01 Coding or something.
0:20:59 – 0:21:01 Coding or something.
0:21:01 – 0:21:08 Fixed bugs in the software I wrote.
0:21:01 – 0:21:08 Fixed bugs in the software I wrote.
0:21:08 – 0:21:13 Can I also optimize software or have it written,
0:21:08 – 0:21:13 Can I also optimize software or have it written,
0:21:13 – 0:21:17 which detects weak points, investigates.
0:21:13 – 0:21:17 which detects weak points, investigates.
0:21:17 – 0:21:24 And there were already some examples and not only about the current PAP problem.
0:21:17 – 0:21:24 And there were already some examples and not only about the current PAP problem.
0:21:24 – 0:21:36 ready-made software that can be automatically scanned to find websites that can be exploited and attacked.
0:21:24 – 0:21:36 ready-made software that can be automatically scanned to find websites that can be exploited and attacked.
0:21:36 – 0:21:43 Jo, we're living what's going on in this view at a very interesting time and
0:21:36 – 0:21:43 Jo, we're living what's going on in this view at a very interesting time and
0:21:43 – 0:21:48 Yes, we should really be thinking about
0:21:43 – 0:21:48 Yes, we should really be thinking about
0:21:48 – 0:21:51 Cybersecurity.
0:21:48 – 0:21:51 Cybersecurity.
0:21:51 – 0:22:08 I know that it is now a totally stupid and banal episode, but I found this to be an important topic for me, because I have now dealt with it for a few days and have also exchanged with a few blog operators.
0:21:51 – 0:22:08 I know that it is now a totally stupid and banal episode, but I found this to be an important topic for me, because I have now dealt with it for a few days and have also exchanged with a few blog operators.
0:22:08 – 0:22:14 Or someone said, yes I'm waiting for WordPress to do an update. No.
0:22:08 – 0:22:14 Or someone said, yes I'm waiting for WordPress to do an update. No.
0:22:14 – 0:22:23 Either your provider, your hosting provider that provides your URL and website, does that.
0:22:14 – 0:22:23 Either your provider, your hosting provider that provides your URL and website, does that.
0:22:23 – 0:22:27 Or you have to change it yourself.
0:22:23 – 0:22:27 Or you have to change it yourself.
0:22:27 – 0:22:38 Yes, because with WordPress, the software that makes the website, this problem has absolutely nothing to do.
0:22:27 – 0:22:38 Yes, because with WordPress, the software that makes the website, this problem has absolutely nothing to do.
0:22:38 – 0:22:46 Ok, I thank you for listening and would be happy if you are back next time, when it is called "The Debauchery".
0:22:38 – 0:22:46 Ok, I thank you for listening and would be happy if you are back next time, when it is called "The Debauchery".
0:22:46 – 0:22:48 Goodbye, Sasha.
0:22:46 – 0:22:48 Goodbye, Sasha.
0:22:48 – 0:22:52 [Music]
0:22:48 – 0:22:52 [Music]
0:22:52 – 0:22:54 [Music]
0:22:52 – 0:22:54 [Music]
0:22:54 – 0:22:57 [Music]
0:22:54 – 0:22:57 [Music]
0:22:57 – 0:23:03 [Music]
0:22:57 – 0:23:03 [Music]
0:23:03 – 0:23:09 [Music]
0:23:03 – 0:23:09 [Music]
0:23:09 – 0:23:15 [Music]
0:23:09 – 0:23:15 [Music]
0:23:15 – 0:23:21 [Music]
0:23:15 – 0:23:21 [Music]
0:23:21 – 0:23:24 [Music]
0:23:21 – 0:23:24 [Music]
0:23:24 – 0:23:30 [Music]
0:23:24 – 0:23:30 [Music]
0:23:30 – 0:23:36 [Music]
0:23:30 – 0:23:36 [Music]
0:23:36 – 0:23:42 [Music]
0:23:36 – 0:23:42 [Music]
0:23:42 – 0:23:48 [Music]
0:23:42 – 0:23:48 [Music]
0:23:48 – 0:23:51 [Music]
0:23:48 – 0:23:51 [Music]
0:23:51 – 0:23:57 [Music]
0:23:51 – 0:23:57 [Music]
0:23:57 – 0:24:03 [Music]
0:23:57 – 0:24:03 [Music]
0:24:03 – 0:24:09 [Music]
0:24:03 – 0:24:09 [Music]
0:24:09 – 0:24:15 [Music]
0:24:09 – 0:24:15 [Music]
0:24:15 – 0:24:18 [Music]
0:24:15 – 0:24:18 [Music]
0:24:18 – 0:24:24 [Music]
0:24:18 – 0:24:24 [Music]
0:24:24 – 0:24:30 [Music]
0:24:24 – 0:24:30 [Music]
0:24:30 – 0:24:36 [Music]
0:24:30 – 0:24:36 [Music]
0:24:36 – 0:24:42 [Music]
0:24:36 – 0:24:42 [Music]
0:24:42 – 0:24:45 [Music]
0:24:42 – 0:24:45 [Music]
0:24:45 – 0:24:51 [Music]
0:24:45 – 0:24:51 [Music]
0:24:51 – 0:24:57 [Music]
0:24:51 – 0:24:57 [Music]
0:24:57 – 0:25:03 [Music]
0:24:57 – 0:25:03 [Music]
0:25:03 – 0:25:10 [Music]
0:25:03 – 0:25:10 [Music]
0:25:10 – 0:25:13 [Music]
0:25:10 – 0:25:13 [Music]
0:25:13 – 0:25:19 [Music]
0:25:13 – 0:25:19 [Music]
0:25:19 – 0:25:25 [Music]
0:25:19 – 0:25:25 [Music]
0:25:25 – 0:25:31 [Music]
0:25:25 – 0:25:31 [Music]
0:25:31 – 0:25:37 [Music]
0:25:31 – 0:25:37 [Music]
0:25:37 – 0:25:40 [Music]
0:25:37 – 0:25:40 [Music]
0:25:40 – 0:25:47 [Music]
0:25:40 – 0:25:47 [Music]
0:25:47 – 0:25:55 [Music]
0:25:47 – 0:25:55 [Music]
0:25:55 – 0:26:03 [Music]
0:25:55 – 0:26:03 [Music]
0:26:03 – 0:26:06 [Music]
0:26:03 – 0:26:06 [Music]
0:26:06 – 0:26:12 [Music]
0:26:06 – 0:26:12 [Music]
0:26:12 – 0:26:18 [Music]
0:26:12 – 0:26:18 [Music]
0:26:18 – 0:26:24 [Music]
0:26:18 – 0:26:24 [Music]
0:26:24 – 0:26:30 [Music]
0:26:24 – 0:26:30 [Music]
0:26:30 – 0:26:33 [Music]
0:26:30 – 0:26:33 [Music]
0:26:33 – 0:26:39 [Music]
0:26:33 – 0:26:39 [Music]
0:26:39 – 0:26:45 [Music]
0:26:39 – 0:26:45 [Music]
0:26:45 – 0:26:51 [Music]
0:26:45 – 0:26:51 [Music]
0:26:51 – 0:26:58 [Music]
0:26:51 – 0:26:58 [Music]
0:26:58 – 0:27:07 [Music]
0:26:58 – 0:27:07 [Music]
0:27:07 – 0:27:09 [Music]
0:27:07 – 0:27:09 [Music]

On 21 October 2026, many websites suddenly faced a serious problem: Two critical vulnerabilities in PHP forced hosting providers to take drastic protective measures. LautFunk was also affected. But what actually happened? And why can a bug in a programming language endanger so many Internet services?

In this edition of divergence I'm talking about the PHP vulnerabilities, the response of my hosting provider Uberspace and the frightening dependence of many websites on few basic technologies.

It's not just about the failure itself. I also explain why outdated PHP versions pose a significant security risk, why some operators cannot easily update their software, and why regular security updates are so important.

I also report my own attempt to switch LautFunk to PHP 8.5. The surprising result: The website continues to work and especially the Podlove Web Player loads felt significantly faster. A good reason to talk about WordPress, databases, caching and the technical basics of modern websites.

In the second part, it becomes more fundamental: What role does artificial intelligence play in the discovery of new vulnerabilities? What happens if the same technologies are used for attacks? And can we even talk about secure software as long as unknown vulnerabilities exist?

My own experiences with an earlier security incident at LautFunk are also included in this consideration.

A personal digression about PHP, WordPress, Uberspace, cybersecurity and the uncomfortable realization that our digital infrastructure is more vulnerable than we sometimes believe.

Further sources: