Fear of PHP may have faded from our feeds, but the cleanup is far from over. Last week, two critical bugs in an open source language that powers about 70% of websites sent organizations scrambling to fix their systems, with some taking their sites offline until the vulnerabilities were patched. According to the researchers who discovered the bug, this is just the beginning, as AI changes the rate at which new vulnerabilities are discovered and exploited.
In this episode of TechCrunch’s Equity podcast, Rebecca Bellan speaks with Tomer Schwartz, CTO of Exposure Management & AppSec at Google’s Wiz, who joined OpenAI, research group Calif, and the PHP team in the bug fix battle. On this show, Schwartz and Beran talk about what the race was like from the inside, how early-stage startups build with security in mind, and why manual patching doesn’t scale.
Listen to the full episode to hear more about what’s next.
Tomer talks about why Wiz couldn’t have found these bugs without AI and how he tested dozens of ideas over a weekend using custom tools. How did a bug stay hidden for more than a decade, and what changed to make it exploitable? Why the leak is almost part of the Systematic Disclosure and how Wiz planned it. Who hasn’t been patched yet and whether small business owners with WordPress sites need to worry?
Subscribe to Equity on YouTube, Apple Podcasts, Overcast, Spotify, and all casts. You can also follow Equity on X and Threads at @EquityPod.
