Glonce

Wiz CTO on two critical PHP bugs and AI-speed vulnerability hunting

securityThe Glonce editorsTechCrunch🔥51Glonce rating51Impact45Novelty35Relevance80Surprise35Players45Credibility65
Wiz CTO on two critical PHP bugs and AI-speed vulnerability hunting

TechCrunch's Equity podcast has put out an episode about the aftermath of two critical bugs in PHP, the open source language behind roughly 70% of websites. The bugs surfaced last week and left organizations scrambling to fix their systems. Some took their sites offline until the vulnerabilities could be patched.

TechCrunch's framing is that the scare may have faded from feeds, but the cleanup is far from over. According to the researchers who found the bugs, this is only the beginning, because AI changes how quickly novel vulnerabilities can be uncovered and exploited.

The guest is Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz. Host Rebecca Bellan talks with him. Schwartz was part of the scramble to fix the bugs, working alongside OpenAI, the research group Calif, and the PHP team.

The episode description says the two get into what the race looked like from the inside, how early-stage startups can build with security in mind, and why patching by hand won't scale.

The source is a short episode description rather than a transcript. It gives no CVE identifiers, no technical details of the flaws, and no account of what each party contributed, so the substance of Schwartz's remarks is not available beyond the topics listed.

Key facts

  • Two critical bugs in PHP, the language behind roughly 70% of websites, were disclosed and fixed last week, per TechCrunch's Equity podcast description.
  • Organizations scrambled to fix their systems, and some took sites offline until the vulnerabilities were patched.
  • Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, worked on the fix alongside OpenAI, research group Calif, and the PHP team.
  • According to the researchers who found the bugs, this is only the beginning, because AI changes how quickly novel vulnerabilities can be uncovered and exploited.
  • The episode covers the race from the inside, how early-stage startups can build with security in mind, and why patching by hand won't scale.

Why it matters

PHP runs roughly 70% of websites, so critical bugs in it reach a very large share of the web. The researchers who found them say this is only the beginning, because AI changes how quickly novel vulnerabilities can be uncovered and exploited. TechCrunch adds that the cleanup is far from over, even if the scare has left people's feeds.

Who it affects

Organizations running PHP-based sites were the ones scrambling, and some took sites offline until the vulnerabilities could be patched. The episode also addresses early-stage startups, in the context of how they can build with security in mind.

How to use it

This is a podcast episode, not a tool or a fix. It is available on YouTube, Apple Podcasts, Overcast, Spotify and other podcast apps. The description lists three topics: the view from inside the race to fix the bugs, building security into an early-stage startup, and why manual patching won't scale.

How solid is it

The incident itself is reported as fact by TechCrunch: two critical PHP bugs, a scramble, and some sites taken offline. The forecast that this is only the beginning is attributed to the researchers who found the bugs, not stated as established. Schwartz's own statements are not quoted in the source, which is a short episode description rather than a transcript.

Risks and caveats

The description names no CVE identifiers, affected PHP versions or technical details, and it does not say how many organizations were affected. It does not say whether the bugs were exploited in the wild or how AI was used to find them. It also does not say who found which bug or what OpenAI's or Calif's specific roles were. Treat the episode as commentary on the incident, not as a technical disclosure.