The brief, in full

Dinis Cruz 0:00 Okay, so there's a big vulnerability flying around at the moment, and I would like to use this as a good case study for what we can do in the newsroom. But it's also a good way to explore other ways to visualise and to map a lot of this stuff. Right. So the first phase that I would like us to really focus on is to really understand and visualise and create infographics and detailed information about this vulnerability, right? And and I think that this is a good example of the power of the technology that we can do. So let's kind of really go to town on the whole provenance and inaccuracy of this, because I was reading the reports and there's some crazy statistics lying around that don't add up that I really want to understand, and is actually a good example of of adding provenance and explainability to to this, and also accuracy to To this environment, which is, you know, it's something that we we talked a lot about, and now I think it's a good time to explore, right? And and a lot of this is it's not about naming and shaming a lot of this stuff, but it's also about you know making sure that the data is actually correct, right, and the statement is actually correct, and also figuring out good ways to find sources and then follow the rabbit holes, and also in a way help journalists, right? Because I don't think I think this is definitely a good example of journalists that don't fully understand Technology that makes mistakes which are not either correct or not factually correct or not seeing the whole picture of the whole thing. So, what I would like us to do is I would like us to basically map this as an incident. Basically, try to find as many sources of information as we can create a full agentic workflow here. We we're basically going to leverage the power agents to map the data. We're going to use both ChatGPT and Claude that I have access to to connect the data, and we want to I want to understand, as an executive, for example, what exactly is going on, and I want to do briefings at all sorts of different levels, and in a way is a good example of of the workflows that we've been talking about all the way back to the cyber boardroom, right? So, so we're going to create a dedicated website for this, and and we're going to start by mapping out and understanding exactly the vulnerability, exactly the attack vector, exactly the exploits, the vulnerable systems, and especially tracking information, mapping out who is saying what? Who is actually communicating? You know, who's basically finding new? Like, what's new? What's a new piece of information? What's being recycled? And I'm especially interested in in basically in the provenance of some of these news, and it's like who's who's bringing it in, who's reporting it, you know, what's the sequence of events, right? And also visualising a lot of this because there's a lot of moving parts on this stuff, right? So the the first thing that I would like is to start off. You know, basically there's multiple threads here. There's this sort of information gathering, raw data, which we're going to use volts for, there is the understanding and mapping what exactly is going on, the current state of affairs, what's being exploited, what's the vulnerabilities, etc. Right? That exists, and this is a vulnerability that was kind of there for a while, but they thought it was theoretical, and now somebody discovered it, and then it's being a little bit botched up because somebody leaked it, and and now they they rush to do a patch, right? So there's a lot of things here who are not adding up, you know, and and I really want to understand more, right? But also, one of the most important things to understand here is we need to map the blast radius, right? Because this feels like a loss for J. This feels like a kind of a kind of the the sort of you know vulnerability that is in software that everybody no that a lot of people use, right? And and that's kind of the first one. Like the first one, I want to really understand is, is the exposure here, right?

Dinis Cruz 5:04 Because the some of the reports say like 70% of the internet is impacted. Some of the reports say tonnes of websites are impacted, and we need to understand that, right? We need to understand, okay, you know, you know there is there's a difference between a vulnerability that literally brings 70% down of everything, or even 20% down, versus this, right? The the thing that also is important to take into account, right, is that first of all, we need to map out. Okay, so this this does remote code execution on on a website, right? But it doesn't mean that the website is compromised. Well, everything is compromised from day one, right? But what means it means that that website is compromised. But it depends what you're going to do with it, right? Depends what's on either side. Depends what credential exists on that website. Depends on what information exists on a website. So that needs to be mapped, right? It also depends on what type of website actually exists, right? And and what are the assets? So so the first kind of thing to do is to really map out what what would a compromise of that website mean? And this is with a threat model. It's a great way to map this out in blast radius and understanding how this works. And we can actually provide some interesting toolkits and vaults and examples for for how to how to to help with this, right? Because you know, again, this is just the first step, right? So, for example, like if you have a website that has you know a bunch of protections on the other side, right? Like you know, it's a bit like I think yesterday I wrote a document that was basically saying, you know, yes, you can have all the credentials for a website, but if you can't use them, then that's not a problem. Now people already done, you know, shell, you know, PHP for shell on this, which is an example of the weaponization. So you now have remote code execution, but then what signals do you have? Like you know, and this is important, right? It's important to understand that a zero day like this is not invisibility cloak, right? So we have to be objective, right? We have to be objective from a point of view of what actually is being exploited, and what are the signals for that exploitation, right? Which is very important. And and then the other element here is also how many sites have actually been exploited, and what's the path, and what is actually happening on the ground because this is also an important signal, right? It's important signal to say, you know, if this is that vulnerable, then you would see a ridiculous amount of exploits, right? Especially if they're being weaponized, right? And I think it's important to track this over time because you would see, you know, this sort of level of exploitation happening throughout the throughout the day and throughout the the months, right, or the the hours, and you would see this sort of massive spike of attacks, right? Because the point here is that we have to start with the assets, right? You have to start with what's on the other side, what's exposed, what's actually, you know, being exploited on this, and then what's the consequences. So we we need to basically start from the whole premise of mapping out what exists, mapping out the latest status of the research, the actual vulnerability. You know, find really good sources, which I'm sure they start to be, of of what the actual vulnerability is, and also think about, you know, what would the website dedicated to this vulnerability look like? You know, like it's almost like, well, if we're going to create the perfect website for tracking this vulnerability and and mapping it out, what would it look like? What would we have? What do we need to capture what's basically the the information about it, and then we need to start, you know, mapping the structure, right, of of the vulnerability.

Transcribed by https://otter.ai

Dinis Cruz 0:00 So this is again for the agent that is gonna help set up the website for the PHP vulnerability. So this is gonna be a website that is like a dedicated sub site. I think we're gonna call it stories, but in story, right? So it's going to be something like newsroom. So it's going to be like PHP or CVEX, PHP 2026. We need a headline for this for the domain name, at and then I'm not sure if there's a name already for it. dot story dot newsroom dot esquitoai, and and that website is going to be basically our reference website that we're going to basically set up a full agentic workflow to be as fact driven as as we can, and well, we might we might want to do some analysis on it, but but the idea is to be as fact driven as possible, so not opinionated, not. I think I think maybe the thing to do is to maybe leave for now the newsroom. What's it called? The main newsroom to have facts and opinions about it, where we put that into context, etc. And what we do is we we basically create this website that has fundamental. multiple audiences, and also shows the agentic workflow from journalist to researcher to security professional to PHP expert to analyst to board member to advisor. So we can create all these roles, and then we can basically create messaging for different roles, and we can basically create sort of a a website that can follow the story. But there's a couple of very important points that I really want us to to do, because I want to do this as a way to also capture the provenance and how the story changes over time, and how data maps out, and how accurate things are, and and that's why we need to have the whole semantic fractal graph, and we need to have this whole sort of converting the graphs, converting the the data that we get into graphs, and then connecting the dots, and then finding the evidence, and then you know finding the facts, opinions, and really go deep on it, right? And and like, and a good example is like, for example, the internet has the BBC has that 70% of the internet is impacted, which is a crazy statement. Which then you look at the source, and the source says 70% of websites are impacted, and they look at it. Say 70% of websites that we can measure the language are impacted. Now, I've been in security and technology for a long time, and I and I could I don't buy that 70% of websites out there, especially some sort of websites that matter, that have a huge amount of information, are a impacted. B don't have other ways to protect this, right? Because because what we have to take into account is that, and this is what I want to understand: is like you know where is the vulnerability, how it can be exploited, how it can be detected, like can you protect? Can you can you put a simple patch in front of it, right? Like, can you do a a fix? There was things they say you can remove some stuff from the website, right? So let's let's also map out what can you actually do to fix it, what can you do to to mitigate it, you know, like if you have a vulnerable system, what what are the steps? Because at the end of the day, we should map out like all the steps. If you have a vulnerable system, we should have a full-blown guide, backed with evidence, backed with basically the guidance to how you're going to fix it, what you're going to do about it, what's what's the deal? What's the what's it called? What's the the steps and and you know and that you should do before, doing, after, including like the whole you know putting a website offline is an option, but should be like at the end of a long sequence of events, right? But also, it should be one of those things where companies should be able to do it very quickly, right? Like you know, this is the whole pull the plug, right? You know, like how fast can you pull the plug of a system, right?

Dinis Cruz 4:52 And in principle, you if you have a good system flying around, and if you have a good tech stack, right, you should be able to reasonably quickly, right? You know, remove a website from being offline. In fact, that's good practice, right? And you should also be able to monitor all the traffic, and you should be able to monitor and detect exploitation, right? Because this is quite a thing. And now, so then the question becomes: How easy it is to detect? How easy it is to detect exploitation? Does it show up in the logs? Do you have good signatures? Can can a wife protect it? Can can intrusion detection tools protect it? Can you? Is there things that you can deploy right now? So let's create a website that has also the best of what's out there. Find out who's who. Who are the researchers? Who are the people pushing good advisory? What is good data about it? What's fact? What's fiction? And I really want us to track expectation numbers, and I want us to track patches numbers. I want to track like which systems are vulnerable, which systems are not vulnerable. You know, all of that.

Transcribed by https://otter.ai