Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
- ID
- 40478
- Status
- summarized
- Published
- 29 Oct 2026, 3:05 AM
- Fetched
- 29 Oct 2026, 3:07 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/video/wizs-cto-on-php2shell-and-the-coming-vulnpocalypse/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 6.0
- Created
- 29 Oct 2026, 3:08 AM
- Tags
- Audience
- developersvibe_coderssaas_startup_founders
What happened
TechCrunch's Equity episode features Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, discussing two critical bugs in the open-source language behind roughly 70% of websites; some organizations took sites offline until they could patch. Researchers quoted say this is only the beginning because AI is changing how quickly novel vulnerabilities can be uncovered and exploited. Schwartz was part of the scramble alongside OpenAI, research group Calif, and the PHP team.
Why it matters
For anyone shipping PHP, the concrete detail is the ~70% web footprint and the fact that some orgs took sites offline until patches landed. But the item gives no CVE IDs, affected versions, or patch guidance, so don't treat it as a remediation checklist; use it to decide whether your deploy pipeline can push a PHP patch without manual work, since Schwartz argues hand patching won't scale.
Discussion angle
What would your team actually do in the first hour after a critical PHP vulnerability with no patch yet: take the site offline, or keep it up with mitigations? Test that against your current deploy pipeline, because the podcast's claim is that manual patching won't scale.