The PHP scare may have faded from feeds, but the cleanup is far from over. Two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to patch, with some taking sites offline until fixes were applied. On the latest episode of TechCrunch’s Equity podcast, Rebecca Bellan talks with Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the response effort alongside OpenAI, research group Calif, and the PHP team.

Schwartz describes the race from the inside and explains why the researchers view these findings as just the beginning: AI is changing how quickly novel vulnerabilities can be uncovered and exploited. He says Wiz could not have found these bugs without AI, and that custom tooling tested dozens of ideas over a single weekend. The conversation also covers how a bug sat in plain sight for more than a decade and what changed to make it exploitable, why leaks are almost baked into coordinated disclosure, and how Wiz planned for those leaks.

For builders, the episode turns practical: how early-stage startups can build with security in mind, and why patching by hand won’t scale as AI accelerates vulnerability discovery. Schwartz and Bellan also address who is still unpatched and whether small business owners running WordPress sites need to worry.