- Nick Woodhead said he went 48 hours without sleep while helping patch a major website vulnerability.
- The CTO said that with security problems piling up, October feels like "the month of hell" for tech.
- Because AI makes it easier to find and exploit security gaps, Woodhead expects more disruption.
This is an as-told-to essay based on a conversation with Nick Woodhead, founder of the AI company GPTree and chief technology officer at Rothco and Compubox. He spoke with Business Insider on Thursday to share how he's responded to vulnerabilities in the PHP programming language that could affect the majority of the world's websites. The following has been edited for brevity and clarity.
It's always a nightmare when these things happen. Since Tuesday evening, I haven't slept. It's coming close to 48 hours working on this. I'm a CTO, but I also run an agency for multiple clients and have my own company with my own product. So, balancing my time to get everything updated — it's just been exhausting.
About 70% of the internet runs on a programming language called PHP. I'm actively involved within the PHP community itself, so I did get a warning on Tuesday evening regarding the vulnerability and the fact that it was already being addressed by the PHP team. That gave me a head start.
I have some teams offshore, so I was able to jump on that with them.
It's not just applying the patches. It's making sure that nothing was already exposed. We already had infrastructure in place to easily deploy patches, but it still requires a good amount of manual involvement.
I knew that as soon as I walked into the office on Wednesday, I'd have to have my teams jump on this. They were already waiting for the patches to be released.
People are willing to help
One of the biggest headaches, especially on the client side, is that we have a lot of legacy systems, which are running on older versions of PHP that are no longer supported, and official patches are not going to be produced. For those, we ultimately had to come up with other plans. For example, taking sites temporarily offline or moving them behind VPNs.
Eventually, because it's an open-source community, those patches have already been backported, or implemented, by the community. So now we're shuffling back to some of those older systems to get them patched.
That's one of the nice things about PHP. There's such a vast community of people all willing to roll up their sleeves and jump in and help.
Even though I've been in leadership for the last 10 years, I've never taken my hand off the pulse in terms of being connected with the code and the infrastructure. So, I've been hands-on with the development and infrastructure teams to help make sure these issues are resolved. We've been reviewing logs and looking for any potential signatures of a breach that this vulnerability exposed.
The month of hell
It's also meant keeping up to speed with the latest news that's coming out and what other people are finding. We're in a position now where we feel comfortable and safe, but there are new vulnerabilities in the coding tool Node.js. We have some Node services, so now we're looking at how that potentially affects us. October just seems like the month of hell from a technology perspective.
I don't think there is an end in sight with the advancements in AI. For all the positives we get from it, there are a whole bunch of negatives, and this is a perfect example.
OpenAI has already stated that they found many more of these types of vulnerabilities that, thankfully, haven't been leaked. Over the coming months, they are either going to be patches or this information is going to get leaked in the same way and cause the same kind of panic.
I don't think we're at the end of the road yet. There's going to be a lot more to come.