The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO

Two critical vulnerabilities in PHP, the open source language behind roughly 70% of websites, forced organizations to take sites offline until patches landed, and Wiz CTO of Exposure Management & AppSec Tomer Schwartz said on TechCrunch's Equity podcast that this is only the beginning as AI accelerates how quickly novel vulnerabilities are uncovered and exploited. Schwartz said Wiz could not have found the bugs without AI, with custom tooling testing dozens of ideas over a weekend, and he worked alongside OpenAI, research group Calif and the PHP team on the fix. Schwartz argued that patching by hand won't scale, and the episode also covered how one bug sat in plain sight for more than a decade before becoming exploitable.

The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/ , with some taking sites offline until the vulnerabilities could be patched. According to researchers who found the bugs, this is only the beginning, as AI changes how quickly novel vulnerabilities can be uncovered and exploited. On this episode of TechCrunch’s Equity https://techcrunch.com/podcasts/equity/ podcast, Rebecca Bellan talks with Tomer Schwartz https://www.linkedin.com/in/tomer-schwartz-800847b5/ , CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the scramble — alongside OpenAI, research group Calif, and the PHP team — to fix the bugs. On the show, Schwartz and Bellan get into what the race looked like from the inside, how early-stage startups can build with security in mind, and why patching by hand won’t scale. Listen to the full episode to hear more about: - Why Tomer says Wiz couldn’t have found these bugs without AI, and how custom tooling tested dozens of ideas over a weekend. - How a bug was able to sit in plain sight for more than a decade, and what changed to make it exploitable. - Why leaks are almost baked into coordinated disclosure, and how Wiz planned for it. - Who’s still unpatched and whether small business owners running WordPress sites need to worry. Subscribe to Equity on YouTube https://www.youtube.com/@TechCrunch , Apple Podcasts https://itunes.apple.com/us/podcast/id1215439780 , Overcast https://overcast.fm/itunes1215439780/equity , Spotify https://open.spotify.com/show/5IEYLip3eDppcOmy5DmphC?si=rZDFHv2sQUul g94iCRgpQ , and all the casts. You can also follow Equity on X https://twitter.com/EquityPod and Threads https://www.threads.net/@equitypod , at @EquityPod.