Wiz CTO warns critical PHP flaws behind 70% of websites are far from fully patched

Two critical bugs in the web's most common language

In late October, two critical vulnerabilities in PHP — the open-source language that, according to TechCrunch, runs roughly 70% of websites — forced organizations into an urgent round of emergency work. Some took their sites offline entirely until fixes could be applied. TechCrunch covered the aftermath in an Equity podcast segment published October 28, featuring Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned security firm Wiz.

Although the story has largely faded from news feeds, the work behind it has not. That is the core of the segment's warning: the cleanup is far from over, and incidents like this one — referred to in TechCrunch's coverage as PHP2Shell — may become more frequent rather than less.

Inside the fix

Schwartz was part of the scramble to remediate the bugs. According to TechCrunch, the coordinated effort also involved OpenAI, the PHP project itself, and a research group named in the segment as Calif. On the show, he and host Rebecca Bellan discussed what that race looked like from the inside, how early-stage startups can build with security in mind from the start, and why patching by hand will not scale.

The researchers who found the flaws argue that this episode is only the beginning, because AI is changing how quickly novel vulnerabilities can be uncovered — and, in turn, how quickly they can be exploited. The episode's framing points toward what it calls a coming "vulnpocalypse."

AI compresses both sides of the timeline

The argument, as relayed by TechCrunch, is that machine assistance now accelerates offensive research alongside defensive work. When both the discovery of a serious bug and the development of an exploit for it can happen faster, the window between disclosure and attack narrows. Organizations that still depend on engineers manually applying patches across large numbers of systems will struggle to close that window in time — which is precisely why Schwartz contends that hand-patching cannot keep pace with the problem.

For smaller companies, the discussion turned to getting this right early. Building security into products from the founding stage, rather than retrofitting it after an incident, was presented as the more sustainable path for teams that lack dedicated security staff.

Why it matters

PHP's reach is what makes this story significant. A critical flaw in a language running roughly 70% of websites, per TechCrunch's figures, is not a niche vendor issue — it is an internet-wide event, and the precautionary outages reported in the immediate aftermath show how disruptive the response can be.

The longer-term concern is the tail. Headlines move on quickly, but deployed PHP installations across hosting providers and applications take far longer to reach, which is why the cleanup remains incomplete.

The broader warning extends past PHP itself. If AI shortens the path from finding a vulnerability to weaponizing it, manual remediation becomes the bottleneck in the entire defensive pipeline. For engineering teams, the practical takeaway is to treat fast, automatable patching — and security designed in from the beginning — as baseline infrastructure rather than an afterthought.