The PHP Scare Is Over. The Cleanup — and the Next Wave — Is Not

The headlines about the PHP vulnerabilities may have faded, but the work they set off has not. According to TechCrunch, organizations are still cleaning up after two critical flaws in the open-source language that powers roughly 70 percent of websites — and the people who found the bugs warn that this episode is only a preview.

A scramble across the web

Last week, the two bugs left organizations rushing to fix their systems, TechCrunch reported, with some taking sites offline until patches could be applied. The flaws, dubbed PHP2Shell, touched a language so widely used that the response pulled in an unusually broad coalition: the PHP team itself, along with researchers and major technology companies.

That breadth is part of the story. Tomer Schwartz, chief technology officer for exposure management and application security at Google-owned Wiz, was part of the scramble, according to TechCrunch, alongside OpenAI, research group Calif and the PHP team. Schwartz discussed the episode on TechCrunch's Equity podcast, hosted by Rebecca Bellan, describing what the race to fix the bugs looked like from the inside.

Why this time is different

According to the researchers who uncovered the flaws, the PHP incident points to a structural shift rather than a one-off scare. Artificial intelligence is changing how quickly novel vulnerabilities can be found — and how quickly they can be exploited. Discovery that once took months of painstaking manual work can now happen far faster, which compresses the window between a flaw being found and it being used against unpatched systems.

That is the heart of what Schwartz calls the coming "vulnpocalypse": a world in which vulnerabilities arrive faster than the old playbook can handle. Patching by hand, system by system, will not scale when the volume and velocity of flaws keep climbing, the podcast discussion argued.

What smaller teams should take from it

The conversation also turned to what early-stage startups can learn from the episode. Building with security in mind from the start — rather than bolting it on after a product is already live — was a central theme, according to TechCrunch. For small teams without large security staffs, that means treating secure defaults and patching discipline as part of the product itself, not as an afterthought to be dealt with when something breaks.

The PHP scare is a useful test case precisely because it was so ordinary. It did not involve an exotic technology or a niche target. It involved the plumbing of the web itself, used by most of the sites people visit every day. If fixing two bugs in that plumbing required a scramble involving some of the biggest names in technology, the lesson is that the next wave — arriving faster, thanks in part to AI — will demand a faster, more automated response from everyone else too.

Written by the BidAsk Newsroom. Based on reporting from the sources below.