Wiz CTO Warns of 'Vulnpocalypse': AI-Found PHP Flaws Threaten 70% of Websites
By Ali Al-Montaser — Senior AI Technical Editor
Wiz CTO Tomer Schwartz revealed two critical PHP vulnerabilities, present for over a decade, were discovered using AI and patched with OpenAI and the PHP team. Since PHP powers ~70% of websites, the flaws—dubbed the start of a 'Vulnpocalypse'—highlight the urgent need for AI-driven security tools to counter faster vulnerability discovery and exploitation.
Executive Overview
In a stark warning to the cybersecurity community, Tomer Schwartz, CTO of Exposure Management and Application Security at Google-owned Wiz, announced the discovery of two critical vulnerabilities in open-source PHP—the language powering approximately 70% of websites. The flaws, which had existed for over a decade, were found with the assistance of AI tools and patched in collaboration with OpenAI and the PHP team. Schwartz describes this as the beginning of a 'Vulnpocalypse'—a wave of newly discoverable and exploitable vulnerabilities accelerated by artificial intelligence. The incident underscores the urgent need for AI-powered security tools to keep pace with the speed of vulnerability discovery and exploitation.
📊 Official Technical Specifications & Data Sheet
| Technical Aspect | Confirmed Official Data |
|---|---|
| 💰 Pricing & Usage Cost | No direct cost for the fix; PHP is open source and free. Security updates are available at no charge to all users. |
| 🌐 Platforms & Immediate Availability | Updates are immediately available via the official PHP repositories (php.net) and all hosting providers supporting PHP. |
| ⚡ Performance & Speed Benchmarks | Vulnerabilities were discovered over a weekend using custom AI tools that tested dozens of ideas. No specific speed metrics were disclosed. |
| 🛡️ Security & Breach Resistance | The two vulnerabilities were critical and had been exploited. They have been successfully patched. Users are advised to update PHP immediately to the latest secure version. |
| 🧠 Context Window | Not applicable (not an AI model). |
| 🌍 Arabic Language & Regional Support | Updates are available globally, including all Arab countries. No regional restrictions. |
Deep-Dive Features & Architecture
In an interview on TechCrunch's Equity podcast, Tomer Schwartz revealed that the two vulnerabilities—whose full technical details remain undisclosed—had been present in PHP for more than ten years. What made them dangerous was their recent exploitability due to changes in the technical environment. Schwartz confirmed that Wiz could not have discovered these flaws without AI, as the team used custom tools to test dozens of ideas over a weekend. This new approach to vulnerability discovery raises concerns that attackers may also use AI to find new flaws more rapidly.
The fix was achieved in collaboration with OpenAI, the Calif research group, and the PHP team, demonstrating the importance of public-private cooperation in countering cyber threats. Schwartz noted that leaks in the coordinated disclosure process are almost inevitable, and Wiz planned for that. He also warned that manual patching will not scale in the future, necessitating automated AI-driven solutions.
Benchmark & Competitive Performance
No specific performance metrics or benchmark comparisons were announced in the report. However, the speed of vulnerability discovery using AI (within a weekend) significantly outpaces traditional methods that can take weeks or months. This positions Wiz at the forefront of companies using AI in cybersecurity, alongside firms like OpenAI that collaborate on similar efforts.
Industry Impact & Enterprise Adoption
For developers and users in the Arab world, this warning carries particular significance because about 70% of global websites rely on PHP, including many Arabic sites. Arab companies and developers must update their systems immediately to avoid breaches. It also highlights the need for AI-powered security tools that are available in Arabic and affordably priced for startups in the region. This could open the door for local solutions using AI to discover vulnerabilities in Arabic applications.
Conclusion
The discovery and rapid patching of these vulnerabilities serve as a wake-up call for everyone: the internet relies on legacy code, and AI is accelerating the pace of vulnerability discovery. Organizations must invest in automated security tools and continuous updating. Future outlook suggests a wave of similar vulnerabilities, making collaboration between security firms and open-source communities imperative.
Media Source: TechCrunch AI | Fact Verification & Analysis: AI Tools Oasis
Frequently Asked Questions
Two critical vulnerabilities in open-source PHP, which supports about 70% of websites, were discovered with the help of AI. The flaws had existed for over a decade and were recently exploited, prompting an urgent patch.
According to the report, approximately 70% of websites rely on PHP, meaning millions of sites could be at risk if not updated to the latest secure version.
A team at Wiz discovered the vulnerabilities using AI tools, in collaboration with OpenAI, the Calif research group, and the PHP team. The flaws were patched after a weekend-long effort.
Yes, all website owners using PHP should immediately update to the latest secure version. The vulnerabilities were critical and had been exploited, so updating is essential to prevent compromise.
'Vulnpocalypse' is a term coined by Wiz CTO Tomer Schwartz to describe an expected wave of new security vulnerabilities that can be discovered and exploited rapidly thanks to AI. This threatens internet infrastructure, especially legacy systems.
AI Tools Oasis Team
Bringing you the latest news and analysis in the world of Artificial Intelligence with accuracy and credibility. Follow us for all updates.
