Wiz Warns Aging Code Could Trigger a “Vulnpocalypse”

Security researchers are warning that aging internet code could create a wave of serious vulnerabilities as artificial intelligence speeds up discovery and exploitation. A TechCrunch podcast examined that risk through the recent PHP2Shell incident, which affected widely used PHP systems. The episode also explored why manual patching cannot keep pace with a software ecosystem built on old dependencies. The warning is relevant to both large platforms and small businesses running popular website software.

PHP2Shell involved two vulnerabilities in PHP, an open-source language used by many websites and web applications. Researchers said the flaws enabled unauthenticated remote code execution, meaning attackers could take control of vulnerable systems without first obtaining a password. TechCrunch’s report on the PHP2Shell incident

The bugs remained dormant for years before researchers found reliable ways to exploit them. The PHP Foundation released fixes on October 21, but many organizations still needed to identify affected servers, test the updates and deploy patches.

PHP’s reach made the incident especially serious. TechCrunch reported that the language runs on roughly 70% of the web, including systems built with WordPress, Drupal, Joomla and MediaWiki. The percentage describes web-facing sites using PHP, not the share of every website that was necessarily vulnerable.

The podcast page says researchers at Calif discovered the PHP flaws through the Patch the Planet initiative, involving OpenAI and Wiz. Wiz later helped verify the proof-of-concept exploits. The episode description says Tomer Schwartz, Wiz’s CTO for Exposure Management and Application Security, discussed the response and the role of AI-assisted tooling.

The supplied headline refers to Wiz CTO Ami Luttwak, but the episode page identifies Schwartz as the guest. Luttwak is Wiz’s co-founder and chief technology officer, according to the company’s author page. This attribution difference matters, so this article refers to the episode guest as Schwartz.

Calif’s technical write-up says researchers used an AI assistant during the investigation. However, the researchers also stressed that expertise about PHP’s history guided the work. “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.” — Calif researchers. Calif’s PHP2Shell technical write-up

The PHP incident shows why vulnerability management is difficult for businesses. A company may run a vulnerable component indirectly through a website platform, plugin, framework or hosting image. Security teams must then map the dependency, determine exposure, apply the correct fix and check whether attackers already tried to exploit it.

The challenge grows when software components remain in use for decades. Open-source projects often depend on small teams and volunteer maintainers, while millions of organizations rely on their code. A patch may exist quickly, but that does not mean every affected system can receive it quickly.

Wiz said its researchers monitored PHP2Shell exploitation attempts after disclosure. In a blog post dated October 27, the company said none of the attempts it observed had succeeded. That finding reduces the evidence for a mass compromise, but it does not remove the need to patch exposed systems. Wiz’s PHP2Shell exploitation update

Organizations should inventory internet-facing software and identify any PHP runtimes or products that depend on them. They should apply the PHP Foundation’s fixed releases, review logs for suspicious activity and restrict unnecessary public exposure. Teams that cannot patch immediately should follow vendor guidance for temporary mitigations, while treating those measures as short-term steps.

Security teams should also prepare for AI-assisted vulnerability research. AI can help test ideas, search code and automate repetitive analysis, but it does not replace knowledge of a target’s architecture or history. Companies need patching plans, asset inventories and clear ownership before the next critical flaw appears.

For more coverage of cybersecurity, software security and artificial intelligence, readers can visit Diaspora Digital Media’s Tech section.

In conclusion, the PHP2Shell incident illustrates the risk created by old code that remains central to modern internet services. AI may help researchers find and test vulnerabilities faster, but expertise and coordinated disclosure still shape the outcome. The next major test will be whether organizations can turn faster discovery into faster remediation.