The ‘Vulnpocalypse’ Looms Over Aging Code, Warns Wiz CTO

Two critical vulnerabilities in PHP — the language powering roughly 70 % of the web — forced organizations to scramble for patches last week, with some taking sites offline until fixes were applied. Researchers who uncovered the bugs say this episode is only the beginning, as artificial intelligence accelerates the rate at which novel weaknesses are found and exploited.

On a recent podcast, Tomer Schwartz, CTO of Exposure Management & AppSec at Google‑owned Wiz, described the weekend sprint that brought together Wiz, OpenAI, the research group Calif, and the PHP core team. Schwartz emphasized that without custom AI tooling the team could not have tested dozens of exploitation ideas in such a short window.

Why it matters for GPU / AI infrastructure

• AI‑assisted vulnerability hunting scales far beyond manual code review, reducing the window of exposure for cloud workloads.
• GPU‑heavy AI pipelines often run on shared infrastructure; a single unpatched library can compromise multiple tenants.
• Automated remediation integrated into CI/CD pipelines becomes essential as the volume of discovered flaws grows.

Schwartz warned that coordinated disclosure inevitably leaks details, and that small businesses running WordPress or similar PHP‑based platforms remain at risk if they rely solely on manual updates. The consensus: patching by hand will not scale in an era where AI can surface new attack vectors daily.