The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO
- ID
- 40480
- Status
- summarized
- Published
- 29 Oct 2026, 2:50 AM
- Fetched
- 29 Oct 2026, 3:07 AM
- Provider
- TechCrunch Startups
- Category
- startup
- Original URL
- https://techcrunch.com/podcast/the-vulnpocalypse-is-coming-for-the-internets-aging-code-says-wizs-cto/
- Source URL
- https://techcrunch.com/category/startups/feed/
Summary
- Score
- 6.0
- Created
- 29 Oct 2026, 3:08 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Wiz's CTO of Exposure Management & AppSec, Tomer Schwartz, describes the response to two critical PHP bugs that hit the open source language behind roughly 70% of websites, with some organisations taking sites offline until patches landed. Wiz says it could not have found the bugs without AI — custom tooling tested dozens of ideas over a weekend — and that one bug sat in plain sight for more than a decade before something changed to make it exploitable. The work involved OpenAI, research group Calif, and the PHP team, and the episode also covers who is still unpatched and whether small WordPress site owners should worry.
Why it matters
If you run anything on PHP — a WordPress site, a legacy Laravel app, a client's brochure site — the concrete takeaway is that a decade-old flaw became exploitable and some teams pulled sites offline rather than risk it, so check your PHP minor version and whether you can patch without a full redeploy. The bigger decision is cadence: if AI tooling can surface dozens of exploit ideas in a weekend, a quarterly patch window is the wrong shape for your stack.
Discussion angle
Wiz says hand-patching won't scale — so what does your patch path actually look like for a PHP or WordPress dependency? Ask the room who could ship a critical PHP patch in under 24 hours without taking the site down, and what would have to change to make that true.