A week of hacking around the world

Since the disclosure of the php2shell vulnerability, our company Calif has been flooded with interview requests from The New York Times, CNN, ABC, NBC, Fox, Reuters, the BBC, and The Times.

Before that, we had given The Wall Street Journal an exclusive on the story.

One call from the BBC went something like this:

"Hello, is this Calif?"

"Yes."

"Do you have a press office?"

"No. We have Microsoft Office, but we haven't used it in ages."

The woman on the other end didn't seem to get the joke. There were a few seconds of silence.

"Could I speak to someone in charge?"

"Sure. There are three of us, but the other two are exhausted and have gone to sleep. I suppose you'll have to speak to our CEO, Thai Duong."

"Yes, could you put me through to the CEO?"

I cleared my throat and changed my voice. "Thai Duong speaking."

The reporter burst out laughing. She probably hadn't expected the CEO to be answering the phone himself.

We could finally joke around a little after the disclosure. The week leading up to it, though, had been harrowing.

Off to Hexacon to hack the iPhone

On Oct. 11, I left San Francisco for Paris. Bruce Dang and I were scheduled to give the opening talk at Hexacon, one of France's leading hacker conferences. At the same conference last year, Ivan Krstić, Apple's head of security, had introduced Memory Integrity Enforcement, or MIE. Apple was offering a US$2 million bounty for a successful iPhone hack. Clearly, the company had high hopes for MIE.

In April this year, we managed to bypass MIE on a MacBook. It was an unexpected breakthrough and something of a dress rehearsal for our real target: The iPhone. We chose it because it's one of the best-protected devices in the world. Apple invests heavily in security and treats privacy as a major part of its business strategy.

Among hackers, the iPhone is a prize coveted by research teams, vulnerability brokers and intelligence hacking units alike. For all its protections, though, it has never been impossible to break into.

Still, from the introduction of MIE on the iPhone 17 until this year's Hexacon, nobody had publicly demonstrated a successful hack.

Apple was offering $2 million, while prices on the black market had reportedly reached eight figures. And at Hexacon, we announced our result: We had successfully hacked the iPhone 18.

We demonstrated four attacks. To be clear, these days I'm just management, which means I don't know how to do anything anymore. I just talk.

The actual work was done by Dion Blazakis, Anna Groza and Stefan Esser. Bruce and I gave the presentation.

First came an attack through Signal, the messaging app known for its security. Next was iMessage, Apple's own messaging service, which the company had worked so hard to protect. The remaining two demonstrations showed how we could jailbreak the device, gain the highest level of control over it, and keep that jailbreak intact even after a reboot.

The entire room watched with bated breath before erupting into applause. Someone recorded the demonstration and posted it on Twitter.

News that Calif had jailbroken the iPhone 18 spread quickly. That was Oct. 16.

A week later, on Oct. 23, Apple began shipping the iPhone Duo. We managed to jailbreak that one on launch day, too.

But between those two dates, the team had another major disclosure to prepare for.

Visiting PDH, hacking PHP

I love going to Paris because that is where Professor Phan Duong Hieu and his family live. Hieu is the son of Professor Phan Dinh Dieu, one of Vietnam's best-known independent intellectuals, a man admired for his candor and who helped lay the foundations of the country's information technology sector.

Hieu is now a cryptography professor at Télécom Paris and lives south of the city.

He has recruited, mentored, and supported around 30 Vietnamese students pursuing cryptography and cybersecurity studies in France.

Whenever I visit, he invites them over to eat, chat, and sing. The atmosphere is always warm and relaxed.

On Saturday afternoon, Bruce and I went to his house and stayed until nearly dawn. After hours of conversation, Bruce turned to him and asked:

"Hieu, are you always this happy?"

That one question summed him up perfectly. But perhaps another reason we are such good friends is that we share many of the same concerns about our homeland. That's a story for another time.

Early Sunday morning, I got up to see Bruce off at the airport, then went out to buy bread with Hieu. French bread is delicious. Every time I visit, I eat several loaves.

As soon as we got home, it was back to work. We were planning to disclose php2shell on Thursday, Oct. 22.

php2shell is a critical vulnerability in PHP, the technology behind a large proportion of websites on the Internet. It allows attackers to take control of websites, steal data or use compromised servers as a foothold for further attacks.

The potential impact was so widespread that several countries had to temporarily take websites offline to apply patches.

Ryan Austin, a Calif team member based in Florida, had discovered and reported the vulnerability in early August. Fixing it took a long time because it involved a complicated set of bugs. Partway through the process, a key member of the patching team was hospitalized for several weeks.

The disclosure, originally planned for September, had to be postponed until October.

By early October, we were working with OpenAI, Wiz, and the PHP Foundation in a joint group, meeting every day to discuss patches and coordinate the disclosure.

Bruce and I were both swamped at the time. The company was growing quickly, and new responsibilities kept piling up. I had considered flying to Florida to prepare everything with Ryan, but Hexacon got in the way.

Even as the disclosure date approached, Calif's materials were still nowhere near ready.

I knew we had a great story to tell, one that stretched back 22 years.

The php2shell vulnerability Ryan had found belonged to a class of bugs first discovered by Stefan Esser in 2004.

Stefan is a veteran hacker with more than 30 years of experience, and he had just successfully hacked the iPhone. Ryan had admired Stefan since he was a kid. More than 20 years later, the two were colleagues at Calif.

I wanted to tell that story through a film or a comic, so I asked Michal Zalewski, another colleague at Calif, what he thought. Michal said making a film would be difficult because everyone lived so far apart. A comic seemed more practical. I also remembered the excellent comic Google had made when it launched Chrome.

Luckily, everything came together. Ryan told the story, his wife Stephanie drew the illustrations, and Michal handled the editing.

There was one thing we had overlooked: registering the domain name php2shell.com.

By the time we remembered, someone else had already registered it in mid-October. Bruce and I had not intended to build a separate website for the vulnerability, but the domain quickly became a source of anxiety. I suggested using it as a shared landing page linking to each team's write-up, but we could not reach an agreement before the disclosure.

Ryan was worried that his contribution would not receive proper recognition. He had put an enormous amount of effort into this research. For a researcher, a discovery like this could be career-changing.

Then, on Tuesday evening, information about the vulnerability leaked. We still do not know where the leak came from.

The PHP Foundation moved the disclosure forward by a day, to Wednesday, Oct. 21.

That left us just one day to finish everything. The comic was not done. The article was not ready. Meanwhile, the other organizations had enormous communications teams behind them.

I worried that if they published first, Ryan's story would get lost in the coverage.

Ryan wanted to release a video demonstrating the attack, which he had already prepared. But as soon as we posted it, the video began spreading rapidly. The PHP Foundation asked us to take it down because it revealed some information ahead of the agreed disclosure time.

I took it down.

The video contained no sensitive technical information and did not provide enough detail to reproduce the attack. Even so, releasing it early was a mistake, and the decision was mine.

My concern for Ryan was genuine, but it did not justify breaking the agreed disclosure schedule.

So we kept grinding away. Every evening, we worked through dinner. In France, everything seems to happen slowly. People eat slowly, and even the Internet is slow.

On the final night, I worked late, handed the remaining edits over to Bruce and Ryan, and tried to get some sleep. But I could not, and so got up and went back to work.

I finally managed about two hours of sleep close to dawn before getting ready to take a train to Frankfurt for my flight back to San Francisco.

Looking back, I should have stayed in Paris.

Fortunately, the train had Wi-Fi, and so I kept working along the way.

I arrived in Frankfurt at 3 p.m., with an hour to go before the scheduled disclosure. We had just managed to get everything ready.

Rather than waste time going to a hotel, I looked for a restaurant near the station where I could charge my laptop and keep working.

It was drizzling outside.

We went into an Indian restaurant. Bollywood music was blaring, but there were power outlets, and that was good enough for me. I found a secluded table toward the back, hoping to concentrate.

Then I discovered the Internet was not working.

I was fumbling around trying to connect to 5G when, sometime after 3:30 p.m., the PHP Foundation published its announcement, about 30 minutes earlier than the schedule I was following.

The other organizations published their articles almost immediately, and the news spread like wildfire.

Ryan and Bruce started messaging me, asking where I was.

I could see their messages, but my replies wouldn't go through.

How's that for irony? After days of preparation, at the very last minute, I was defeated by an Internet connection.

I got up to look for another restaurant. As I walked toward the entrance, my phone suddenly picked up a 5G signal.

And so, in the end, I published our PHP2Shell disclosure from that very Indian restaurant.

Thankfully, Ryan's contribution received clear recognition. Both The Wall Street Journal's article and the PHP Foundation's announcement acknowledged that he had discovered and reported the vulnerability and developed exploit code for it.

That work had helped establish just how serious the problem was.

Ryan had also worked day and night testing the patches.

Some people say getting credit does not matter. I think you would have to be in Ryan's shoes to understand.

When you have spent months working on something that could change your life, of course you want your contribution to be properly recognized.

Over the following days, our phones and email inboxes exploded with interview requests from news organizations around the world.

Ryan became an overnight star.

I'll have more to tell about this husband-and-wife team of hacker and artist.

Calif invests in research because we want to build knowledge and accomplish things nobody has done before.

For me, though, there are also stories like this one.

I've always been curious about what goes on behind the scenes of extraordinary hacks.

I told Bruce that, years from now, I probably would not remember how much money we had made.

But I would remember that drizzly afternoon, desperately searching for a 5G signal to disclose a PHP vulnerability from an Indian restaurant beside Frankfurt station, with Bollywood music booming in the background.

For a lifetime spent hacking, that is enough.