AI is helping developers build faster, but it is also changing how quickly hackers could discover and exploit vulnerabilities. A recent security scare involving PHP shows why the next cybersecurity crisis might be bigger than we expect.

What if a security flaw had been hiding in the software powering much of the internet for more than a decade, and AI helped researchers finally expose it?

That is what happened with PHP2Shell, a set of critical vulnerabilities discovered by researchers at cybersecurity company Wiz. The incident has raised concerns about a future in which AI dramatically accelerates the discovery and exploitation of software vulnerabilities.

Speaking to TechCrunch, Tomer Schwartz, CTO of Exposure Management and Application Security at Wiz, warned about the growing risks posed by aging software and increasingly capable AI systems.

What Is PHP2Shell?

PHP is a programming language used to build websites and web applications. According to Wiz, it powers roughly 70% of websites worldwide, including platforms built using WordPress, Drupal, and Joomla.

On October 21, 2026, Wiz disclosed two critical vulnerabilities in PHP’s core engine, tracked as CVE-2026-109618 and CVE-2026-109619.

These flaws could allow unauthenticated attackers to execute code on vulnerable servers or access sensitive information stored in process memory, potentially exposing passwords, authentication tokens, and API keys.

The concerning part? The underlying bugs had existed for years, but exploiting them required an exceptionally complex combination of technical steps.

AI helped change that equation.

Wiz researchers used advanced AI models and custom testing tools to identify the flaws, develop exploit techniques, and help validate fixes. The company worked with the PHP security team, OpenAI, and research group Calif to coordinate disclosure and remediation.

The PHP team released security patches on October 21. Source: Wiz Research

Why Is AI Making Cybersecurity More Complicated?

Traditionally, discovering and exploiting sophisticated vulnerabilities required deep technical expertise, considerable time, and extensive testing.

AI can help researchers analyse code, explore possible weaknesses, test hypotheses, and debug complex problems much faster.

That creates a double-edged sword.

The same technology that helps defenders discover hidden vulnerabilities can also help attackers develop and adapt exploits.

For cybersecurity teams, this means previously overlooked weaknesses could become practical attack opportunities much faster than before.

In its October 27 update, Wiz reported observing a limited number of PHP2Shell exploitation attempts but had not identified successful exploitation in its telemetry at that time. The company also noted that some partners had privately disclosed working exploits against various targets.

The immediate response has been encouraging, with organizations working to patch affected systems. However, the broader challenge remains: many businesses operate on legacy software that is difficult to update.

What Does This Mean for Startups?

For startups, cybersecurity can easily become an afterthought. Early-stage teams often prioritize launching products, acquiring customers, and raising funding, leaving security updates until later.

PHP2Shell is a reminder that vulnerabilities can exist below the application layer. Even when a startup’s own code is secure, weaknesses in its underlying software can create serious exposure.

Founders and technical teams should regularly update PHP and other dependencies, maintain an inventory of internet-facing systems, monitor security advisories, and verify that critical patches have been applied.

Organizations that cannot patch immediately should follow official mitigation guidance from their hosting provider and security team.

Waiting for an attack before addressing known vulnerabilities is an increasingly risky strategy.

Is the ‘Vulnpocalypse’ Really Coming?

The term vulnpocalypse describes a potential future in which AI dramatically increases the pace at which vulnerabilities are found and exploited, overwhelming organizations that cannot respond quickly enough.

It does not mean a universal cybersecurity collapse is inevitable.

AI can also strengthen security by automating code reviews, detecting suspicious activity, identifying weaknesses, and helping developers fix problems before attackers exploit them.

The outcome will depend on how quickly defenders adopt these capabilities and improve their patching processes.

As Schwartz discussed with TechCrunch, manually fixing vulnerabilities one by one will become increasingly difficult as the volume and speed of discovery grow.

The Bigger Picture

PHP2Shell is more than another software vulnerability story. It illustrates a turning point in the relationship between AI and cybersecurity.

The internet relies on enormous amounts of software, including systems built years ago that remain essential to businesses today. AI is making it easier to examine that code, but it is also reducing some of the barriers that once slowed sophisticated attacks.

For founders, developers, and businesses, the message is clear: security cannot be treated as a one-time task after a product launches. It must become an ongoing part of building and maintaining technology.

The real race is no longer just between hackers and security teams. It is between the speed at which vulnerabilities can be discovered and the speed at which they can be fixed.

Read the original discussion in TechCrunch’s interview with Wiz’s security leadership.

Follow Tepi AI for the latest AI developments, cybersecurity news, and technology trends that matter to founders.