Equity

The 'Vulnpocalypse' is coming for the internet’s aging code, says Wiz’s CTO

31 min

In this episode of Equity, guest Tomer Schwartz, CTO of Exposure Management and AppSec at Wiz, discusses the critical PHP vulnerabilities known as 'PHP2 Shell' that threatened much of the internet. He explains the coordinated disclosure process, the role of AI in discovering the bugs, and the challenges of patching at scale. The conversation highlights the growing cadence of such critical vulnerabilities and offers advice for startups on building resilient security practices.

Summarized by Podsumo

🎙️ Ask about this episode

✨ Key Takeaways

1

The PHP bugs, present in code for over a decade, allow unauthenticated remote code execution, impacting roughly 70% of web-facing servers relying on PHP.
2

Tomer Schwartz details how Wiz used its AI harness 'Project Atlas' to supercharge vulnerability research, enabling a small team to find critical bugs in days instead of months.
3

The coordinated disclosure timeline was accelerated after information leaked, leading to a scramble to patch and a variety of defensive measures across the industry.
4

Despite patches being released, a majority of workloads remain unpatched, leaving many systems vulnerable, especially among smaller businesses and legacy systems.
5

The episode concludes with advice for startups: build security-resilient architectures from the start and consider early security hires to keep pace with the increasing frequency of critical vulnerabilities.

💬 Notable Quotes

"_"I didn't think that we could have found it without AI. So the opportunity for a team of 10 of the most talented people... if we had taken all of them and told them, hey, maybe find some PHP RCE bugs, maybe it would have taken them a couple of months of work, maybe even 12 months of work._" — Tomer Schwartz"
"_"We're seeing that still a majority of workloads are not patched. It takes a lot of time to actually fully patch a live website... I do worry that we're gonna see this tail of unpatched systems for quite some time now._" — Tomer Schwartz"
"_"AI is changing everything about not only cybersecurity, but also the underlying IT infrastructure... for those startup companies that are already out there, I think if you haven't thought about how to reinvent yourself given the changes are happening, then now's probably the best time to do this._" — Tomer Schwartz"