Two critical bugs in PHP, the open source language behind roughly 70% of websites, sent organizations scrambling last week. Some companies took their sites offline until they could patch. According to TechCrunch AI, the researchers who found the flaws say this is only the start, because AI is speeding up how fast new vulnerabilities get found and exploited.
On TechCrunch’s Equity podcast, Rebecca Bellan spoke with Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz. Schwartz worked on the fix alongside OpenAI, the research group Calif, and the PHP team. His main point is blunt: patching by hand won’t scale.
Why PHP2Shell Is a Warning Shot
The headlines have moved on, but the cleanup hasn’t. That gap is the real story. When a bug hits software this widespread, the hard part isn’t writing the patch. It’s getting that patch onto millions of servers run by teams that don’t know they’re exposed.
Who fixed it matters too. An AI lab (OpenAI), a cloud security company (Wiz), an independent research group (Calif) and the volunteer maintainers of PHP all worked the same incident. That’s what the new response model looks like. AI companies aren’t watching security from the sidelines anymore. They’re in the war room.
The ‘Vulnpocalypse’ Math
The worry behind the “vulnpocalypse” label is simple:
- Discovery is getting cheaper. AI models can comb huge codebases for flaws much faster than human researchers.
- Exploitation is getting faster. The same tools that help defenders find bugs help attackers turn them into working exploits.
- Remediation is still manual. Most companies still patch through tickets, change windows and engineers doing the work by hand.
When the first two speed up and the third doesn’t, the window between disclosure and attack shrinks. Attackers only need one unpatched server. Defenders have to cover all of them.
This prediction comes from people with skin in the game. Wiz sells exposure management, so it benefits when companies worry about this. Still, Schwartz isn’t guessing from a distance. He was inside a real coordinated response, and the PHP scramble supports his case: a widely used language, critical flaws, and organizations pulling sites offline because they couldn’t patch fast enough.
What the Next 1-3 Years Look Like
This is where things seem to be heading.
Within a year: Expect more disclosures like this one, in widely used open source projects, found with AI help. The volume of critical CVEs (publicly tracked vulnerabilities) will likely keep rising. Security teams will feel it first as alert fatigue.
In two years: Automated remediation becomes something buyers expect, not a nice extra. Tools that find a vulnerable dependency, write the fix, test it and open the pull request will move from pilot to standard practice. Google’s purchase of Wiz already shows how much the big platforms think this layer is worth.
By year three: The open source maintainer crunch gets serious. Projects like PHP depend on small teams. If AI floods them with valid bug reports, someone has to fund the fixes. Look for AI labs and cloud providers to put more money into core open source security, partly as goodwill and partly out of self-interest.
What Practitioners Should Do Now
You can’t stop the wave, but you can get ready for it:
- Know what you’re running. Keep a current inventory of languages, frameworks and dependencies. You can’t patch what you don’t know you have.
- Time your patch cycle. Measure how long it takes from disclosure to deployment for a critical fix. If the answer is weeks, that’s your biggest risk.
- Automate the boring parts. Dependency updates, testing and rollouts should run through pipelines, not someone’s to-do list.
- Build security in early. Schwartz’s advice to startups applies to everyone. Security added later costs more and moves slower.
- Point AI at your own code first. If attackers are using models to find your bugs, you should be using them too.
The Bigger Picture
The PHP incident shows AI cutting both ways in security. AI helped find these bugs, and AI companies helped fix them. The tooling that closes the gap between discovery and deployment hasn’t caught up yet, and the companies that build or adopt it first will be in the strongest position.
The full conversation with Tomer Schwartz is on TechCrunch’s Equity podcast.