Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
AI-assisted digest, checked against the original source before publishing. How we work
Two critical PHP bugs forced site shutdowns worldwide, and Wiz's CTO says AI-accelerated discovery means the patch race is only getting faster.
Two critical vulnerabilities in PHP — the open source language that underpins roughly 70% of websites — sent organizations into a scramble last week, with some operators taking sites offline entirely until fixes could be deployed. The immediate panic may have faded from feeds, but the remediation work has not, and the researchers who found the bugs say this episode is a preview rather than an outlier.
The fix effort drew an unusual coalition. Tomer Schwartz, CTO of Exposure Management & Application Security at Google-owned Wiz, joined TechCrunch's Equity podcast to describe a response that ran alongside OpenAI, the PHP core team, and a research group called Calif. That pairing — a cloud-giant-backed security vendor, a frontier AI lab, and language maintainers working the same bug — is itself a notable shift in how high-severity open source flaws now get handled.
The researchers' warning is the sharper headline: AI is changing how quickly novel vulnerabilities can be uncovered and, potentially, exploited. Schwartz and host Rebecca Bellan framed the dynamic as a coming "vulnpocalypse," with the episode's shorthand for the incident, PHP2Shell, standing in for a class of bug that no longer stays private for long once it's found.
Beyond the postmortem, the conversation turned practical. Schwartz covered what the race looked like from inside the response, and what early-stage startups should be doing to build with security in mind rather than bolting it on after launch. His central argument is a scaling one: patching by hand won't keep pace with the volume and velocity of modern vulnerability disclosure, which is where exposure management and automated triage come in.
What to watch next is whether the coordinated model — vendor, AI lab, maintainers, and researchers sharing a disclosure window — becomes the template for the next critical open source flaw, and whether the organizations that took sites offline this time around can shorten their own response before the next one arrives. The open question for builders is less whether AI-driven discovery accelerates from here, and more whether their patch and exposure workflows can absorb it.
Key facts
- • Two critical PHP bugs hit a language behind roughly 70% of websites.
- • Some organizations took sites offline until the vulnerabilities were patched.
- • Wiz responded alongside OpenAI, research group Calif, and the PHP team.
- • Tomer Schwartz is CTO of Exposure Management & AppSec at Google-owned Wiz.
- • Researchers say AI is shortening the gap between discovery and exploitation.
Why it matters
The incident reframes patching as a scaling problem: if AI accelerates the discovery of novel vulnerabilities, teams relying on manual remediation will fall behind disclosure volume. Builders should expect more coordinated, compressed response cycles involving vendors, researchers, and upstream maintainers — and treat security-aware architecture as an early-stage requirement, not a post-launch add
Spotted an error? Send a correction.
Get the day's AI news in one email
The Daily Epoch · 60-second read · unsubscribe anytime
