The key facts

  • Two critical PHP vulnerabilities affected infrastructure that, by researchers' estimates, powers about 70% of websites
  • Some organizations took websites offline until patches were installed
  • Tomer Schwartz (Wiz) took part in the fix coordination together with OpenAI, the Calif group, and the PHP team

What happened

In the fall of 2026, two critical vulnerabilities were discovered in PHP — the open programming language that, according to researchers' estimates, powers about 70% of websites: two critical vulnerabilities. Organizations rushed to patch their systems, and some took websites offline until patches were installed. TechCrunch described the situation as a 'PHP-ocalypse': the two vulnerabilities nearly broke the internet, leaving companies in crisis mode.

Who fixed it and what was discussed

In an episode of the Equity podcast, journalist Rebecca Bellan spoke with Tomer Schwartz, CTO of Exposure Management & AppSec at Wiz, a Google-owned company. According to TechCrunch, Schwartz was part of the coordination effort to fix the vulnerabilities alongside OpenAI, the Calif research group, and the PHP team. The conversation covered what this race looked like from the inside, how early-stage startups can build security into development, and why manual patching doesn't scale.

'Just the beginning'

The researchers who found the vulnerabilities warn that this is only the beginning: artificial intelligence is changing the speed at which new vulnerabilities can be discovered and exploited. TechCrunch's episode headline calls it an impending 'vulnpocalypse'. At the same time, the publication contains no technical details about the bugs themselves, no timeline for fully resolving the consequences, and no list of affected organizations — the cleanup, in the outlet's words, is 'far from over'.