Wiz CTO warns of AI-driven “vulnpocalypse” after PHP2Shell bugs

Last week two critical vulnerabilities were disclosed in PHP, the open-source language that powers an estimated 70 % of the web. The flaws, dubbed PHP2Shell, forced many organizations to take sites offline while they applied emergency fixes. In an interview on TechCrunch’s Equity podcast, Tomer Schwartz, chief technology officer of Exposure Management and Application Security at Google-owned Wiz, described the frantic response and warned that the episode may be a preview of a larger “vulnpocalypse” driven by artificial intelligence.

Schwartz explained that the discovery and remediation effort involved a coordinated effort among several parties, including the PHP core team, OpenAI, the research group Calif, and Wiz’s own security engineers. “We were racing against time and against each other,” he said, noting that the speed at which the bugs were identified and weaponized was unprecedented. The rapid exploitation was made possible, he argued, by AI tools that can scan codebases and generate exploit code far faster than traditional manual methods.

The conversation also turned to the practical implications for startups and other early-stage companies. Schwartz emphasized that many of the affected sites were run by small teams that lack dedicated security staff. “If you are patching by hand, you are already behind the curve,” he warned. He advocated for integrating exposure management platforms that can automatically detect vulnerable dependencies and apply patches at scale. According to Schwartz, such automation is the only realistic path forward as AI continues to lower the barrier for discovering new weaknesses.

While the immediate crisis has been contained, the experts on the podcast agree that the underlying trend is unlikely to reverse. The ability of generative AI to produce novel attack vectors means that open-source ecosystems will face a higher frequency of critical bugs. For founders, this translates into a need to embed security into product roadmaps from day one, rather than treating it as an afterthought. Investors, too, are expected to scrutinize the security posture of portfolio companies more closely, given the potential for widespread disruption.

Looking ahead, Schwartz cautioned that the industry must prepare for a shift from reactive patching to proactive defense. He suggested that collaboration between language maintainers, AI researchers, and security vendors will be essential to stay ahead of the next wave of vulnerabilities. As the “vulnpocalypse” narrative gains traction, the onus is on developers and operators to adopt tools that can keep pace with AI-accelerated threat discovery, or risk being caught off-guard by the next critical flaw.