Wiz CTO warns of a “Vulnpocalypse” as PHP bugs expose aging internet code

Last week, two critical bugs were uncovered in PHP, the open-source language that powers roughly 70 % of all websites. The flaws prompted an urgent scramble across the tech ecosystem as organizations rushed to patch vulnerable systems, with some taking sites offline until fixes could be applied. The episode has been dubbed a “Vulnpocalypse,” underscoring the growing risk that legacy code poses to the modern internet.

The race to remediate the PHP issues involved a coalition of security researchers and industry players. Tomer Schwartz, chief technology officer of Exposure Management & Application Security at Wiz, a Google-owned cloud-security firm, was on the front lines alongside teams from OpenAI, the research group Calif, and the core PHP maintainers. Schwartz described the effort as a coordinated “bug-busting” sprint, where each party contributed expertise to develop patches, validate fixes, and disseminate updates to the broader developer community. The collaboration highlighted how quickly novel vulnerabilities can be identified when AI-driven tools are applied to large codebases.

For founders and early-stage operators, the incident serves as a cautionary tale about the limits of ad-hoc security practices. Schwartz emphasized that relying on manual patching is unsustainable at scale, especially as AI lowers the barrier for discovering new attack vectors. Startups building on PHP, or any widely adopted, aging framework, must embed exposure management into their development lifecycles from day one. Automated scanning, continuous monitoring, and rapid response playbooks are no longer optional add-ons; they are essential components of a resilient product roadmap.

Investors are also taking note. The “Vulnpocalypse” illustrates a broader market shift where security posture directly influences valuation and exit potential. Companies that demonstrate robust, automated security infrastructure are likely to attract more capital, while those caught off-guard by legacy-code exploits may face costly downtime and reputational damage. As AI continues to accelerate vulnerability discovery, the demand for platforms that can automate detection, prioritize risk, and orchestrate remediation is expected to rise sharply.

Looking ahead, Schwartz predicts that the industry will see a wave of tools designed to bridge the gap between AI-generated exploit research and practical, scalable patching solutions. He urges founders to partner with exposure-management providers early, integrate security testing into CI/CD pipelines, and allocate resources for continuous code-health monitoring. The PHP episode may be the latest flashpoint, but it signals a longer-term imperative: the internet’s foundational code must evolve, and the organizations that depend on it must evolve faster.