[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast, which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the recent security collaboration between Elementor, and Patchstack.
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast. And you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today, we have Miriam Schwab and Oliver Sild.
Miriam co-founded Strattic, a platform with an aim to revolutionize WordPress security and performance on the web. After Elementor aquired Strattic, Miriam continued leading the unit before becoming a head of WordPress relations.
Prior to that, Miriam founded and managed a prominent WordPress development agency in Israel. With over 15 years of experience, she’s a respected member of the WordPress community and a frequent speaker at WordPress events.
Oliver is the CEO and co-founder of Patchstack, a company dedicated to the mitigation of security vulnerabilities in WordPress and open source environments. Patchstack is now a seven year old enterprise, and they specialize in penetration testing, security process management, and protective services for developers, agencies, and major hosting companies.
[00:02:07] Nathan Wrigley: Oliver’s background also includes experience running an agency, and his work at Patchstack focuses on collaborating with plugin developers and hosting providers to ensure robust security measures for their clientele.
Miriam and Oliver joined me at WordCamp US 2024 in Portland, where they did a presentation discussing the processes needed to enhance open source plugin security, and the advantages of leveraging bug bounty partnerships.
Their collaboration brings to light the importance of integrating security solutions within the WordPress ecosystem, especially for companies with a footprint as large as that of We talk about the global operations of
Oliver’s team at Patchstack, who work across all time zones, providing round the clock threat intelligence and vulnerability monitoring.
We also explore the Patchstack system as a whole and how it categorizes WordPress vulnerabilities based on their exploitation likelihood, and their implementation of virtual patches to protect against high and medium priority vulnerabilities automatically, without code changes.
We also get into how Miriam’s team at Elementor collaborates with Patchstack to ensure rapid and professional handling of vulnerabilities, enhancing security for their 17 million installations.
The partnership between Elementor and Patchstack is a great example of how different companies within the WordPress community are able to work together to provide better outcomes for their users.
If you’re curious about the intersection of page builders and security in WordPress, or the value of collaborative partnerships in maintaining the ecosystem, this episode is for you.
If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so without further delay, I bring you Miriam Schwab and Oliver Sild
I am joined on the podcast today by Miriam Schwab and Oliver Sild. Hello.
[00:04:14] Miriam Schwab: Hi.
[00:04:15] Oliver Sild: Hello.
[00:04:16] Nathan Wrigley: We’re in Portland. We’re at WordCamp US. It is 2024, and Miriam and Oliver have done a presentation, which I think happened yesterday. How did it go?
[00:04:26] Miriam Schwab: I think quite well. I’ve been getting good feedback. What about you?
[00:04:28] Oliver Sild: Yeah, I think it was great. I think, after the talk, we had a lot of people coming to us, and to ask about how they can, you know, replicate that on their plugins as well and it was very good.
[00:04:37] Miriam Schwab: I actually ran into someone who was like, that was the best talk I’ve heard since the start of the conference, just by the way.
[00:04:41] Nathan Wrigley: The title of that presentation was Enhancing Open Source Plugin Security, Establishing Robust Processes and Leveraging Bug Bounty Partnerships. And the podcast today is going to be about a partnership between, well, in Miriam’s case, Elementor, because that’s where Miriam’s working, and in Oliver’s case, Patchstack, because that’s where he’s working.
Before we get into the nuts and the bolts of it though, can we start with Miriam? Can you just give us your little potted bio, like less than a minute, something like that?
[00:05:06] Miriam Schwab: So, hi, I’m Miriam Schwab. I’m head of WordPress relations at Elementor. I act as a type of liaison between Elementor and the broader WordPress community. I joined Elementor about two years ago when they acquired the startup that I co-founded called Strattic, which was static hosting for WordPress. And that’s where my biggest activity around security started to happen. I basically created Strattic to solve security issues around WordPress. That was my biggest motivating factor for founding it. And then after joining Elementor I became quite involved in our security around our plugin specifically, and the processes behind it, and how we communicate with the community at large. And so that’s kind of how this all happened.
Okay, great. Thank you, Miriam. And if you want to hear more from Miriam, I did a podcast episode with her from WordCamp Asia earlier this year. So you can check that out as well. I’ll put a link in the show notes. And, Oliver?
[00:05:57] Oliver Sild: Yeah. I’m Oliver, I’m the CEO and co-founder of Patchstack. Actually, this month we turned seven years old, so already quite a long time. What we do is, we have just one very clear mission, it’s providing the fastest mitigation to security vulnerabilities in WordPress, and in open source. So we work with plugin developers, we do pen testing for them, manage their security processes. We also provide protection for developers and agencies for websites, to protect them from the vulnerabilities. And we work with probably most of the biggest hosting companies, in terms of helping them identify vulnerabilities in their customer’s websites, and also protect them from that.
Yeah, I mean, from my own background, I used to also run an agency, which I think literally everyone has done at one point of the time. I had like a very strong security focus early on, so I did like malware research, and then met my co-founder who did vulnerability research. Fun fact, we met in Reddit. That’s how we actually met. But yeah, also do a lot of community stuff, so organising capture the flag events in Estonia.
Right now, in WordCamp US, we also host a WordPress CTF, so everyone can go and join that. I don’t know when it’s going live, probably it’s over then. There’s a lot going on, and being very active in NGOs. I have co-founded a co-working space in Estonia, which is now a startup center and stuff. So a lot of community, open source and security stuff.
[00:07:14] Nathan Wrigley: Thank you, Oliver, that’s great.
So over the last few years, WordPress has been sort of replete with acquisitions, and then it felt like that dropped off the news and partnerships came along. And that became a big thing, and obviously Elementor, Patchstack partnering up. It seems like a curious thing to be partnering on. One is a page builder, that’s pretty clear, one is security. How did this come about, and what possible benefit is there with a security company partnering with a page builder company?
[00:07:39] Miriam Schwab: So I’ll just start by explaining a bit about my approach to my position at Elementor, which is that, I want to find the ways that we can work together with other companies in the space, even ones that seemingly compete with us. Because there’s generally a place for us to collaborate, we have shared and common users. When we work together, things go better for everyone. I just really feel like there’s a power in two organisations, or companies coming together to achieve goals together. So I do actually quite a lot of that in general.
With Patchstack it’s actually a really straightforward win-win here, I think, and definitely a win for Elementor. So Elementor, the plugin, the core and the free have an active install base of over 17 million websites, right? Which is a mind-boggling number. And that means that everything that Elementor does, we have to do quite carefully, right? Because it can impact the users very positively, and then something goes wrong that’s quite a negative experience.
And that includes security. We need to make sure that the plugin is as secure as possible for this very broad user base. And we have a lot of very robust internal processes around ensuring that the code is secure before it’s deployed and released. But anyone who works in software will know that, no matter what you do, you can do everything and be superhuman, things still might end up having a vulnerability that needs to be dealt with after deployment. It’s just the nature of the game.
So were working with a bug bounty program called Bugcrowd to bring another very significant layer of security to our plugin post-deployment. I was fortunate to meet Oliver, I think it’s like almost two years ago, at least a year and a half ago or something. I had been looking at what Patchstack was doing, I was very impressed. Their specific focus on WordPress plugins, and open source, and also the clear passion that they have for open source, and making open source ecosystems more secure. That really, I think resonated with me and with Elementor.
And so we started to explore whether Patchstack could be a good solution for us to add another layer of security to our plugin, with that angle of expertise in WordPress. And so, you know, we start to explore that and work together, and it’s been successful from day one. And brings a lot of value, not just to Elementor, by bringing their like additional expertise to the table. But also obviously to our end users who can be confident that there’s a very thorough, and professional, and responsible process behind bug disclosure, and how we handle it, and release patches very, very quickly. Our turnaround time is quite fast.
[00:09:58] Nathan Wrigley: So can I just unpack that for the audience who in many cases won’t be particularly technical. So, does the workflow go a bit like this? Elementor creates a new feature, creates an update, has something that they need to push out to the plugin, and that is then created on your side. But then somehow it gets pushed over to Patchstack, and then Patchstack inspect it, check it, make sure that it passes all the tests that maybe they’re using, and then passes it back to you and says, go, no go. Is it basically something like that?
[00:10:25] Miriam Schwab: It’s something like that. I’ll explain a bit, and then I’ll let Oliver like expand on that. Basically, Patchstack receives a report from one of their security researchers that there’s an issue with Elementor. Patchstack gets more than one report, okay, in general, but the additional value that they bring to us is that they review the reports to make sure that what we’re seeing, and then dealing with, are quality reports.
There’s a lot of researchers that just, they’re just looking to report stuff. So they’ll repeatedly report like ridiculous things that aren’t really a problem for anyone, just wasting everyone’s time. So we get high quality reports from Patchstack. We replicate it, you know, we determine the plan of action, and the team creates a patch for it, test it on our end as thoroughly as we can.
Pretty early on within our work with Patchstack, we added a stage, I asked if they could do it, I think it was something like that, and they’re like, yeah, of course. And it’s possible they already did it, but we hadn’t experienced that before, that we then send it to them for review to make sure that it fully resolves the issue. That’s very value add because it’s additional pairs of eyes on it. And once they’ve confirmed, then that actually goes out to release to our users, and all that. But I’ll let Oliver just explain more about that.
[00:11:26] Nathan Wrigley: Yeah. So just to confirm, that is one of the things that’s happening. Once you’ve packaged it up, it gets handed over to Patchstack. Patchstack inspect it, like I said, go, no go, something along those lines. Okay, over to Oliver for the technical details.
[00:11:37] Oliver Sild: So it’s important to understand that our logic is that, the only way how we can provide the fastest mitigation for security vulnerabilities in the WordPress ecosystem is when we cover the entire life cycle of a security vulnerability.
That starts from the point of someone finding it, reporting it to a vendor, patching it, to users getting notified about it, and users getting mitigated, and to the point where they eventually, you know, fix it, right?
Which includes three different key stakeholders, right? So it’s plugin developers, website builders, or like website owners who build websites, and hosting companies who also have like a huge responsibility because they are like hosting that code and everything, right?
So the reason why probably we are one of those only ones that are going to validate the patches is because we need to do it anyways. That’s the very simple answer.
Because ultimately we have responsibility in front of our customers who are using Patchstack to protect their websites. And if we don’t validate the patches that we see, like plugins releasing fixes, then how do we actually know that it’s patched? Because there’s so many cases where vulnerabilities are getting patched by the vendors, but then you look into it and they patch the wrong thing, or they just kind of like messed something up. So for the hackers, it’s very easy to bypass it, and things like that.
So before we tell our customers that, hey, now you don’t have a security vulnerability anymore, we must make sure that it’s the actual case, right? So that’s really where this comes from because yeah, as I said, we cover the entire life cycle. So our customers, developers and agencies who use Patchstack to get their websites, you know, we call it virtual patching, which is like auto mitigation of vulnerabilities in real time.
So to get everything mitigated as soon as possible, and then plugins to fix all the vulnerabilities as soon as possible. And then hosting companies to be able to send out notifications. Everything, we need to basically combine all this into a single process. So internally we could say that we are actually doing one thing, but it just kind of like spans out in three different locations.
[00:13:35] Nathan Wrigley: Where do you get your data from? Where do the data points about what’s going on in the world, for Patchstack, how does that come into you? Have you got like a, I don’t know, like a red team or something like that, or is it just your paid employees that are constantly going out looking? I genuinely have no idea how that information comes in into your inbox if you like, for want of a better word.
[00:13:53] Oliver Sild: So there’s three sources really. We have internal security researchers that do a lot of pen testing, they do a lot of research in general.
Then what we started doing, four years ago already, was we created the first kind of like open bug bounty program for WordPress. So if you, Nathan find the security vulnerability in someone else’s like Miriam’s plugin, then we pay you if you report it.
So we started like incentivising security researchers to start looking for vulnerabilities in the WordPress eco system, because there was so many of them to find. And if you don’t give incentives for hackers to report them properly, then they are going to do something else with it. So that was something that we started doing, yeah, about four years ago already.
And we have like 1,600 people in the community, of like ethical hackers all around the world. We have like a leaderboard system, and they get rewarded. Just two weeks ago, one of the researchers got like 16.4k for a single vulnerability, which we paid out from our own money.
But we do all of that because we want to protect our customers, right? And also it helps to protect the plugins as well, because it gets the plugins, you know, fix the vulnerabilities before, potentially hackers have had time to kind of like do that.
But there’s this third one then, which is the MVDP. So we act as a security point of contact for a lot of plugins. So Elementor is one example, but we have 400 other plugins that actually pass every single vulnerability to Patchstack. So we help them validate those issues. We help them to verify that the patches are complete and everything like that. And that’s also how we basically become like the best security solution for their users, because we are able to protect them very, very fast.
[00:15:28] Nathan Wrigley: So we could be having the same conversation with Miriam with 400 other companies. There are 400 companies with the same kind of relationship. I’m guessing not many of them with 17 million installs. But actually that’s a serious point though. The fact that you’ve got 17 million installs kind of makes this more important than almost any other plugin out there in all honesty. Because if something goes wrong, it’s going to completely break. You know, it’s not like a minor function of your website, it probably is the entire website, the front facing website.
And so I guess you have a pretty big target on your back. You know, if somebody can leverage, or figure out a vulnerability in Elementor, that’s going to be worth more than, I don’t know, plugin X over there that has 24 installs on the repo, or something like that. So the security posture from your side has to be really, really serious.
And so, is it like a bi-directional relationship? Like, if you discover something, and I’m pointing at Oliver. If Patchstack discover something, you can then send it directly to Elementor, and forewarn them about that problem. They can fix their code. But it works in the other direction as well. You don’t know you’ve got a vulnerability, so you pass it to Patchstack, they figured that you have, and it comes back. So it’s this nice circle of virtue where you’re both helping each other out.
[00:16:37] Miriam Schwab: There’s a few different directions that this security relationship works with Patchstack. So one is that they have their community of security researchers, that’s what they’re called, who are basically constantly trying to break into everyone’s stuff. That’s more or less what they’re doing.
Now that could be like, oh no, why are they doing that? That sounds so terrible. But like, they’re not the only ones doing it, right? They’re doing it in order to then report it, so that it can be fixed.
There’s other people who are just like them out there who are doing the same thing for malicious purposes, and don’t necessarily plan on reporting it, but plan on exploiting it.
So we want these security researchers doing what they’re doing, and then reporting it to Patchstack, and Patchstack reports it to us. And then we start this cycle of mitigating it, and releasing a patch that fully resolves it.
Because we’re so big, and we have such a huge code base, so definitely we’re like a target of interest because let’s say the ROI for a hacker, or a vulnerability is high for Elementor, so that’s why we take it seriously in terms of this full circle type of approach to the security before deployments and after deployment, which I described.
But another way that we work with Patchstack is when we get reports that aren’t from Patchstack, because that also happens. But we find a lot of value in making sure that Patchstack is in the loop even on those reports. Theoretically, we could get a report from someone else, and I’ll explain how briefly, but we could get a report from someone else, and then we could just do our own thing. But we want to be as responsible and as transparent as possible around vulnerabilities that exist in Elementor.
From our perspective, security’s not something to be embarrassed about because we know we’re doing everything we can. It’s something to just accept that it’s going to be a thing, but the question is not if, but how? So our how, is to be very, very responsible about it and transparent.
So when we get these reports, we loop Patchstack in, and we tell them that we’ve got this report so that they can be part of the process, and make sure that the loop is closed in the most secure way possible, including that they look at these reports as well, and our patches as well, to make sure that we’re fully resolving it.
[00:18:33] Nathan Wrigley: So you’re sort of patting each other’s backs in a way. You know, something that you get gets passed to them, that’s kind of nice free intel for them. It came to you first, but it ends up at Patchstack, so they can then act on that, and send it out to your other 400 customers if it might affect them. That’s nice.
[00:18:47] Miriam Schwab: I think it helps Patchstack. I can’t speak for Patchstack, but I think it helps for Patchstack to have the full, the full vision of what’s going on with every, let’s say, all plugins that are in their MVD program, which means, by the way, MVDP is managed vulnerability disclosure program. Yes, that’s important because not everyone will know what that is.
To have the full visibility into what’s going on, so when we share that information with Patchstack, it helps Patchstack have more information for everyone, and also for us, Elementor going forward. So there’s like more context for everyone. And then that comes back to this approach of transparency as well.
Again, Oliver can speak to this, probably working with a plugin of our scale, while there’s a lot more at stake here, it brings a lot of learnings into Patchstack because there’s not that many plugins that are at the scale. I think there’s maybe five that are over 10 million active installs in the plugin repository. They recently updated the numbers so that it will show that, at least there’s that. And it’s a whole other ball game when you’re at that scale of size, reach, code base, age, right? Elementor is eight years old, so all that, but Oliver can talk to that.
[00:19:42] Oliver Sild: So one of the things is that, if we look at the data from the past years. In 2023, if we look at all the security vulnerabilities being known, or made public in the WordPress ecosystem, over 76% originated from Patchstack. The number and the volume is incredibly high. And even if we talk about historic data, like all the WordPress historically, Patchstack has processed the highest amount of security vulnerabilities that are biggest amount of them, or even majority I would say.
So that also gives us like some level of experience in terms of how much we’ve had to already work with security researchers. We understand how they like to report things, what are the issues with the reportings, and things like that, but also like how to build processes internally, so you would be able to even like, cope with that kind of a load, right?
So I think there’s this kind of experience we’ve had there, which has allowed us to actually build a solution that works for Elementor, and they have a very high standards. So I think without the hard work we’ve done over the past years, it could have not been possible.
By the way, we provide all of this to Elementor for free, Elementor doesn’t pay anything for providing MVDP service. And we provide this for free for everyone in the WordPress ecosystem. And we built this entire MVDP program, and the platform, together with European Union because European Union is going to pass a law in Q4 that is making this actually mandatory for all commercial open source software.
[00:21:03] Nathan Wrigley: Why do you do it for free? You could see my face, my eyes open thinking, hang on, wait, why?
[00:21:08] Oliver Sild: So, one of the reasons is because European Union funded building it for free, for us as well, right? So we got 2.7 million euros to build it, and to build all the processes and everything around it. European Union understood that WordPress ecosystem is just so massive in scale, and they chose us to do it because of our track record.
And now we are very well connected with that, and as they are, you know, preparing to release this new regulation, which by the way, like even US companies need to comply with. So everyone who has European users, every software that has commercial element to it, like accepting donations, having paid support, having premium version, or even if they’re just not fully free, but like the company that owns the plugin has any commercial activity, they need to comply.
And the things that they need to comply is have a VDP program, which is literally what we built. You need to start releasing patches separately from functional releases. There is going to be a lot of those kind of changes, like you have to notify users about vulnerabilities. You have to notify users later on, also if the vulnerability is getting mass exploited. There’s these kind of rules, and our platform basically pre complies you for that entire regulation.
The reason why we do it also for free is exactly what Miriam told, it’s like we also get visibility. Because as I mentioned, we cover the entire life cycle of vulnerabilities, so our goal is to provide the fastest mitigation to vulnerabilities. And the way to do that is to know about vulnerabilities. So for our end users and to all Elementor users, for example, who are using Patchstack, they know that the fastest way to get protected is from Patchstack, because we work together with Elementor. We work together with other plugins, and that’s how they know that they are getting protected by Patchstack as well.
[00:22:42] Miriam Schwab: So both of us have strange business models, Elementor and Patchstack, because if you think about it, Elementor’s 17 million active installs, the vast majority of them are using our free product, and that’s our business model. And Patchstack’s business model is based also on providing a lot of value for free that then ends up being an actual business model. I wonder if these types of business models, that bring a lot of people value for free, could exist outside of open source, and could exist outside of WordPress.
[00:23:08] Nathan Wrigley: Do you both advertise each other’s presence then? For example, Miriam, do you on your website somewhere say, we have this relationship with Patchstack, I don’t know, protected by Patchstack or something? And again, in the opposite direction, do you say, yeah, one of our customers, Elementor? I don’t know if there’s anything in that.
[00:23:24] Miriam Schwab: We have a page on our site that we make sure is linked to from the footer of every page on our site. It’s called our Trust Center. It’s very important for anyone who has some kind of security process, which everyone should, to have an easy way for people to find how to report issues to the company, because otherwise people might find something, not know how to report it. It ends up in some random person’s inbox, nobody pays attention, and that’s not good for anyone.
So we have this trust page that describes all of our security process and everything, and that links to our Bug Bounty page. It’s a page fully dedicated to just explaining our Bug Bounty program. And it clearly states there that all plugin related issues should be, and need to be reported to Patchstack. And we highly request that people respect that process because it allows Patchstack to make sure that these vulnerabilities are patched quickly, and it allows Elementor to make sure that it’s patched quickly. Which is better for everyone because we have the processes in place based around our partnership with Patchstack.
So that’s clearly visible on our site. And we talk about in different forums, for example, the talk given yesterday, and of course this interview right now. So it’s something that’s quite publicly known.
[00:24:27] Oliver Sild: So what we also have is, on Patchstack, we have a vulnerability database, which is completely free to use in public, where everyone can see what are the latest vulnerabilities. We show people like what the priorities there are and so forth. But it also has a directory of VDPs. So we actually have a directory where you see all the plugins that have VDP programs active.
So that also gives you, as a developer or user, an understanding of like, okay, I want to use a plugin for my website for a specific function, let’s say a page builder. I want to use something that has proper security practices in place. So that’s where we have like this directory where you can go and look into which ones actually have a VDP program.
We also have like a highlighting there for those plugins that are, you know, also contributing more into the community aspect as well. Actually, Elementor is featured there currently.
So, I think having mature security processes is a big competitive advantage for plugins as well, because developers are going to choose stuff that they feel, security is, in general, very hot topic right now. I just talked yesterday with some quite big hosts in the space, and they said that it used to be that everyone was asking about performance, and now everyone is asking about security.
And that also means that this kind of interest to security has, you know, reached the developers and everywhere. And when they make those decisions of, what plugs should I use, they are going to eventually choose the ones that they can trust most.
[00:25:47] Nathan Wrigley: Does it muddy the water a bit? In other words, let’s say that I’m a customer, and I’m out there looking for a page builder. I come to Elementor, I’ve got my site up and running and I’m thinking, okay, I want some sort of security, I’ve heard that security’s a thing on my website. Does it muddy the water? Commercial rivals of Patchstack, for example, is the implication, okay, you must only use Patchstack. Patchstack is our preferred customer, nothing else will work. Do you ever get any intel like that?
And the other way around? You know, if people have got some sort of security posture, but they’re looking for a page builder, do you know what I mean? There could be some sort of misunderstanding, like we only work with Elementor, or we only work with Patchstack. Do you ever get any of that kind of intel where it’s, I don’t know, muddied the water, confused things?
[00:26:25] Miriam Schwab: The way that is generally accepted that companies and products work when it comes to their security processes, and particularly with regards to their bug bounty programs, is that they will define their bug bounty programs, and it is highly requested that people respect that.
That isn’t always the case, and so we have had to put some processes in place where we are capable of accepting reports from other parties or individuals, who for one reason or another prefer to send it directly to us.
So it doesn’t mean that you have to only work with Patchstack. We want reports to go wherever they can go that will make sure that we’ll get them so that we can take care of them. Legitimate reports, right? High quality reports.
But then at that point we loop Patchstack in anyways. And that’s one of the great things about our relationship with Patchstack, they’re not like, oh, they didn’t send a to us so, you know, good luck to you, take care of it yourself. It comes back to this interest in having full visibility. And we want Patchstack’s input in making sure that everything is done properly. Both in terms of us patching it fully and resolving the issue.
But some other things that come up is that sometimes these other reporters send us reports that are not clear. Patchstack sends us reports that are quite clear, replicable, which means that we can recreate them on our end, which helps us figure out how to fix them, right? If you can’t see the problem, you can’t fix it, and well documented. Sometimes we get reports from other sources that are quite unclear. So Patchstack can even help us ask the right questions, or sometimes try to figure out what’s going on there, either we’ll do it ourselves. Basically the process is either directly to Patchstack, then to us. Or to us, and then to Patchstack, and then to us. And then that loop starts from that direction.
So we’re open to working with anyone. We want the reports to come to us. If for some reason people really refuse to work with Patchstack as our bug bouncy program, that’s okay. Patchstack is still part of our bug bouncy process, but we are capable of handling that as well.
[00:28:16] Oliver Sild: We actually work with other security companies. I don’t know if you’re not aware, but like Patchstack is powering vulnerability notification system and V Patching for Solid Security, which was previously known as iThemes Security. We do that for WPMU Defender. We do that for SecuPress. We do that for Shield Security. We do that for WP Guardian, which is a co-product with Patchstack and WebPros.
So I think what is very common between Patchstack and Elementor is that we actually work with everyone, together. Regardless whether they are like a competitor or not. We work with everyone who is willing to work together with us as well. Everything that we do in Patchstack is about collaboration.
As I’m saying, like we work with hosting companies, we work with plugins, we work with developers and agencies. I think that is literally the only way how to succeed in making the ecosystem secure.
In general, I think that allows us to also just make it actually as secure as it can go. And I think, from going forward from here, with all the regulations and everything also coming in, I think it’s the only way really.
[00:29:12] Nathan Wrigley: Let’s take the scenario, Miriam, that you discover, or it is discovered by you, so not by Patchstack, out there in the wild somewhere there’s a serious problem in the Elementor’s code base. And it’s Friday night, and it gets reported to you. I’m just interested, what is the behind the scenes process that you have got set up between you to make things happen in a timely fashion?
So I’m taking the example of, you know, Friday night being the beginning of the weekend, everybody’s going off for a couple of days, this is a bad time to discover it. I’d be interesting to know, how does that get handed off, and how does it then come back? What are the backend systems that you’ve put in place that we’ll never know about, will never be discoverable to us, but I’m presuming they now exist since you’ve partnered up with each other?
[00:29:51] Miriam Schwab: So there’s two types of reports. I mean, there’s a lot of types of reports, but I’m just going to divide them into two categories.
One report, type of report is this issue is being actively exploited. Meaning bad people know about it and are already trying to hack sites with it. Or this issue is some level of severity and needs to be taken care of, but nobody knows about it yet.
Okay, so in the case of the first one, it’s all hands on deck, do or die, let’s fix this. I can’t think that this has happened since we started working with Patchstack, so I’m like theorising here. But, probably we’ll reach out to them in one of our direct channels. So like we have a shared Slack channel with Patchstack, they’re very responsive there.
So it would be like, help, all the sirens. We’re like now dealing with this. If it’s actively exploited, we know we’ll be like, okay, we’re probably already working on it, right?
But, FYI, heads up, we’re going to like be releasing this as soon as possible, please be available so we can send it to you just for review before we do. So that’s one type.
The second type is you can breathe more. There’s different levels of severity. Meaning if between now and some point it’s discovered, if it’s a high level of severity, then oh my goodness. If it’s low level security, then it’s like it’s not going to affect all sites, only going to affect some certain types of users, like that kind of stuff. So it’s like less urgent.
But that probably means that we can all just continue our weekend. I’m theorising again, so nobody should take me at it and be like, what? You’re going to sleep through the weekend with this? No, that’s not what I mean. Each vulnerability is looked at for vulnerability, and if it’s super urgent or highly urgent, then it gets the attention immediately, Patchstack will be pulled in. But if not, then there’s like a pretty clear process around it in terms of internal timelines, and the timelines that Patchstack gives us.
So the reason that Patchstack gives a timeline is because, if they report something, a plugin, developer, or whatever has a certain amount of time within which they need to patch it. It’s better for everyone that that exists. There’s a lot of other things that you want to make a priority, so you could just kind of drag it on. But It will eventually be found.
If something is not patched within the timeframe, then Patchstack has a whole process, which Oliver can explain. But it does get disclosed, let’s say, to the plugin review team, and that’s a serious matter for the plugin then to have to deal with it at that point.
And then we create our own internal timeline in terms of how fast we have to turn around a patch, also based on the level of severity. So if it’s highest level of severity, it’s like really fast, medium, less fast. But our turnaround time, our customers keep raving about it on like bugs, but also security issues, we’re very fast. We take it seriously in all situations. Whether it happens Friday night at midnight or, you know, Sunday morning, because our work week starts a Sunday, that’s a different story.
[00:32:14] Nathan Wrigley: Oliver, just before you begin, I have a friend who’s a medic and he is in trauma surgery. His phone is the conduit to, like the alarms are sounding. Do you have something equivalent to like that? Do you operate a sort of 24/7? I think you said you’ve got a distributed team. So you’re able to react right now, no matter what time of the day or night, 365 days of the year. Is that the kind of thing that you do? I was saying about the weekend, do you all take the weekend off? How does it work?
[00:32:38] Oliver Sild: We do cover all time zones. So we have people in Asia, we have people in Europe, we have people in the US. This is important for us to do threat intelligence and, you know, security research in general.
One thing, also in terms of like a zero days, or like in vulnerabilities in general, one thing that we help the, I would say our developer to sleep over the weekend, is that we are actively monitoring whether this vulnerability is getting exploited or not.
So immediately when we see any kind of like signals that there is an actual exploitation attempt against this vulnerability, they would be notified immediately.
We also take care of this kind of like a background threat intelligence monitoring part, where we know about the vulnerability, so we have signals whether this vulnerability type is getting exploited or not.
[00:33:17] Nathan Wrigley: So you could tell whether a zero day is realistically a zero day, okay. In theory it’s possible, but nobody’s doing anything about it, so maybe we can step down a little bit.
[00:33:27] Oliver Sild: So there’s two things we do. One thing is that we have created what we call Patchstack Priority. And this is like a special scoring made for prioritising WordPress vulnerabilities based on the likelihood of them becoming exploited.
So we have high priority vulnerabilities, which is based on historic data, vulnerability types, and there’s like a lot of data around that shows that this vulnerability, basically we predict that this vulnerability is going to become exploited.
And then we have medium priority, which is vulnerabilities that are potentially going to be exploited in targeted attacks. Doesn’t mean that it’s mass exploited, but it’s like, you know, if you have like a e-commerce store, for example, that holds credit card details, there’s a higher potential that this is going to be used in a targeted attack.
And then there’s low priority, which is like, this is not going to get exploited at all.
Based on that, we also kind of modify our timelines and everything. And also we generate virtual patches based on that, which is the auto mitigation feature that we have for all the high and medium vulnerabilities. We immediately create virtual patches, which are like essentially vulnerability specific protection rules that get automatically deploy to our customer sites without changing any code or anything. It’s very, like a precise way of making sure that this vulnerable function can’t be used in any other way than it was originally intended.
So because of that, we have full visibility into the kind of like a network, whether we see where a specific vulnerabilities are being exploited or not. And that allows us to also basically notify back to the plugin developers later saying like, hey, we now have proof that this vulnerability has been exploited, here’s all the attacker’s information, all that kind of stuff. So we have a lot of data around that as well.
[00:35:03] Nathan Wrigley: I think it’s amazing that WordPress as a CMS is big enough to have a page builder plugin and a security plugin at the scale that they can not only function independently, but also they can create a really meaningful partnership between the two of you. And I have really found this conversation fascinating. It’s really interesting peeling back the curtain and seeing how you’re doing things behind the scenes, if you like, so that you’re protecting all of your customers. Thank you so much, Oliver. Thank you so much, Miriam. Where can we find you online?
[00:35:34] Miriam Schwab: You can find me personally on Twitter at Miriam Schwab. I’m also on Make WordPress Slack, post status Slack, LinkedIn, whatever. And Elementor of course is on all the social networks. We’re active on Instagram, Twitter, our website, elementor.com.
[00:35:48] Oliver Sild: All the same places, but just Oliver Sild.
[00:35:51] Nathan Wrigley: Perfect, and Patchstack.
[00:35:53] Oliver Sild: Yes, patchstack.com.
