The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO

On this week's Equity podcast, TechCrunch's Rebecca Bellan sat down with Tomer Schwartz, CTO of Exposure Management and AppSec at Google-owned Wiz, to walk through the response from the inside. Wiz was part of a coordinated fix effort alongside OpenAI, a research group called Calif, and the PHP maintainers themselves. Schwartz's account of that weekend is the episode's most striking thread: he said Wiz could not have surfaced the bugs without AI, and that the team built custom tooling to test dozens of hypotheses over a single weekend — a pace that manual review could not have matched.

The bugs also illustrate how long vulnerabilities can lurk. Schwartz described one as sitting in plain sight for more than a decade before something changed to make it exploitable. That pattern underlies what he labels the "Vulnpocalypse": a growing backlog of aging internet code whose flaws are suddenly becoming discoverable at machine speed. As AI lowers the cost of finding novel vulnerabilities, the reasoning goes, the defenders' math changes — patching by hand simply will not scale.

The episode also covers the messy reality of coordinated disclosure, where leaks are, in Schwartz's framing, almost baked into the process. Wiz planned for information slipping out before fixes were broadly deployed, which helps explain the frantic patch windows many organizations experienced. Bellan and Schwartz also discussed how early-stage startups can bake security into what they build from day one, rather than bolting it on after the fact.

For smaller operators, the practical question is whether WordPress site owners need to worry. Schwartz addressed that directly in the show, and the answer matters for a long tail of sites running PHP-based stacks without dedicated security staff. Whoever is still unpatched a week out is the real exposure.

What to watch next: how quickly remaining PHP deployments actually update, whether coordinated disclosure becomes more formalized and leak-resistant, and how often AI-driven discovery outpaces patch pipelines. Schwartz's weekend of automated hypothesis-testing is a reasonable preview of the baseline attackers will be working from.

The broader open question for builders is whether hand-patching can survive contact with AI-speed vulnerability discovery, or whether automated remediation becomes the default. Watch for how quickly PHP deployments complete updates, how disclosure processes adapt to recurring leaks, and whether small WordPress operators are left behind in the cleanup.