Wiz CTO Tom Schwartz warns of PHP2Shell vulnerabilities and 'vulnpocalypse

Tom Schwartz, chief technology officer for exposure management and application security at Wiz, warned on TechCrunch’s Equity podcast that the recent PHP2Shell bugs could spark a “vulnpocalypse” as artificial‑intelligence tools make it faster to find and weaponise new flaws. The interview was recorded this week and aired on the podcast’s latest episode.

The two critical bugs, disclosed last week, affect the open‑source PHP language that powers roughly 70 percent of the web. When the flaws were announced, dozens of organisations rushed to shut down vulnerable sites or pull them offline until patches could be applied. The scramble highlighted how deeply PHP is embedded in the internet’s infrastructure and how a single weakness can ripple across millions of pages. Researchers who uncovered the bugs say the episode is only the opening act, because AI now speeds the discovery of novel vulnerabilities and can automate their exploitation.

Schwartz described the race to contain the PHP2Shell issue as a coordinated effort involving Wiz, OpenAI, the independent research group Calif and the core PHP development team. Teams worked around the clock to develop patches, test them and distribute updates. He said the experience underscored a broader problem: fixing code by hand does not scale when AI can generate exploits at scale. Early‑stage startups, in particular, need to embed security into their development pipelines from day one, or risk being overwhelmed by a flood of automated attacks. Schwartz urged companies to adopt continuous exposure‑management platforms that can automatically detect, prioritize and remediate vulnerabilities across their codebases.

Looking ahead, Schwartz expects AI‑driven threat hunting to become a permanent feature of the security landscape. He advises firms to invest in tools that can keep pace with rapid vulnerability discovery and to stay engaged with open‑source communities that maintain critical software like PHP. The next wave of patches will likely focus on hardening the language itself and improving the speed at which updates reach end users. As the internet’s backbone continues to evolve, the ability to respond quickly to “vulnpocalypse” scenarios could determine whether businesses stay online or become collateral damage.