Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
Summary
TechCrunch's Equity podcast interviews Wiz CTO Tomer Schwartz about the critical PHP vulnerabilities that threatened millions of websites, and warns that AI-driven vulnerability discovery could trigger a coming 'vulnpocalypse' that makes manual patching unscalable.
View Cached Full Text
Cached at: 10/28/26, 07:27 PM
Similar Articles
The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO
On TechCrunch's Equity podcast, Wiz CTO Tomer Schwartz discusses the critical PHP bugs that nearly broke the internet and warns of an incoming 'Vulnpocalypse' as AI accelerates the discovery and exploitation of vulnerabilities in aging open-source code.
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
OpenAI's Patch the Planet initiative and Google's Wiz used AI models like GPT-5.6 Sol and Gemini 4 Argon to uncover two critical, decades-old PHP vulnerabilities present since 2004, prompting an NSA warning and urgent patches from the PHP Foundation for the ~70% of websites running PHP.
How many "unexploitable" bugs are about to become exploitable?
Wiz disclosed PHP2Shell, two critical decade-old PHP vulnerabilities that researchers turned into working exploits in about a week with help from Gemini and GPT models, prompting emergency patching and raising questions about AI-driven exploitation of legacy code.
AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web
Two critical PHP runtime vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed php2shell) that had existed for over a decade were demonstrated as exploitable with the help of frontier AI models, prompting a coordinated defense across the web including pre-disclosure Cloudflare WAF protections.
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers had a four-day head start exploiting severe PHP vulnerabilities discovered by OpenAI, Calif, and Wiz, flaws affecting up to 70% of websites worldwide and prompting urgent alerts from the NSA, NCSC, and White House.