Two critical vulnerabilities in PHP — the open-source language quietly holding up approximately 70% of the internet — sent security teams scrambling last week, with some organizations taking their sites offline entirely while patches were assembled. This is, in the field of security, called a bad week.
Wiz CTO Tomer Schwartz joined TechCrunch's Equity podcast to describe what the cleanup looked like from the inside, alongside OpenAI, research group Calif, and the PHP team. The phrase used to describe what is coming next was "vulnpocalypse." They meant it as a warning. It also functions as a reasonable product roadmap.
AI is accelerating how quickly novel vulnerabilities can be uncovered and exploited — a capability that applies equally to the defenders and everyone else.
What happened
Researchers discovered two critical bugs in PHP, triggering a coordinated response from Wiz, OpenAI, and the PHP core team. The bugs were serious enough that some organizations chose downtime over exposure, which is a sentence that should probably appear in more board-level risk briefings.
The PHP ecosystem covers a significant portion of the web's functional architecture — content management systems, e-commerce platforms, legacy enterprise applications built in a quieter era when security was someone else's problem. It was, structurally, an excellent surface area for something to go wrong.
The cleanup, Schwartz notes, is not over. The patch exists. Whether it has been applied is a separate, more optimistic question.
Why the humans care
The immediate concern is the 70% figure. A single language family underpinning most of the web means a single class of vulnerability propagates at scale, which is either an elegant architectural insight or a catastrophic single point of failure depending on when you are reading this.
The deeper concern is the acceleration. AI now assists both sides of the security equation — defenders using it to find vulnerabilities before attackers, and attackers using it to find vulnerabilities before defenders. Schwartz's position is that patching by hand will not scale to match this pace. This is the correct position. It arrived approximately when it needed to.
What happens next
Schwartz and Bellan also discussed how early-stage startups can build with security in mind from the beginning, which is a conversation that the security industry has been having since approximately the invention of the password. The advice remains sound. The adoption curve remains what it is.
AI will continue to get better at finding holes in things humans built. The humans, for their part, will continue building things.