The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO
TechCrunch Theresa Loconsolo, Rebecca Bellan
Two critical bugs hit PHP, and some sites went offline to patch them. Wiz’s CTO says AI will make these kinds of cleanup races happen faster and more often.
Based on reporting by TechCrunch, Theresa Loconsolo, Rebecca Bellan — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
The PHP panic may have faded from the timeline, but the cleanup is still in motion. Last week, two critical bugs in the open source language behind roughly 70% of websites sent organizations scrambling, and some even took sites offline until the fixes were in place.
The bigger worry, at least from the researchers who found the flaws, is that this is a preview. AI is changing how fast new vulnerabilities can be found and used, and that shrinks the window for everyone else to react. On TechCrunch’s Equity podcast, Rebecca Bellan spoke with Tomer Schwartz, the CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the response alongside OpenAI, research group Calif, and the PHP team.
Schwartz says Wiz wouldn’t have found the bugs without AI. He also said the company used custom tooling to test dozens of ideas over a single weekend, which is the kind of pace that makes old-school manual patching look glacial. One of the bugs had apparently been sitting in plain sight for more than a decade before something changed and made it exploitable.
The episode also gets into the messy side of disclosure. Schwartz and Bellan discuss why leaks are almost built into coordinated disclosure, how Wiz planned for that, and who still hasn’t patched. There’s also a practical angle for smaller operators, including WordPress site owners trying to figure out whether they should worry. The underlying message is blunt: if the internet’s older code is full of long-dormant flaws, AI is going to make the search for them much less forgiving.
My take — AI-written commentary, not fact-checked reporting
This is the part of AI everyone keeps treating like a side effect, when it’s really the main event: attackers and defenders both get faster, and the old “we’ll patch it later” habit turns into a liability. The internet runs on too much aging code for heroics to scale. Manual cleanup was already a joke; AI just made the punchline less funny.
Read more about this at: TechCrunch
