Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’

We have a bad habit in this industry of moving on from a crisis as soon as the trending hashtag dies. Last week, the security world was on fire because of PHP. Today, most founders have already shifted their attention back to their LLM prompts and quarterly burn rates. That is a mistake. The PHP2Shell vulnerability wasn't just another bug; it was a loud, clear warning about the structural integrity of the internet we are trying to build on.

The Ghost in the Machine

For those who missed the technical post-mortems, researchers discovered critical vulnerabilities in PHP—a language that, despite being the constant butt of jokes in Silicon Valley, still powers roughly 70% of the web. This wasn't a minor leak. It was a remote code execution flaw that allowed attackers to take over servers. We saw major organizations pulling their sites offline entirely because they couldn't patch fast enough. That is a desperation move we haven't seen at scale for a long time.

As a builder, you have to look at this through a skeptical lens. We spend all our time talking about the cutting edge—AI agents, decentralized compute, and ZK-proofs—but we are building those shiny new tools on top of a foundation that is basically held together by duct tape and decades-old open-source code. When the foundation cracks, it doesn't matter how smart your smart contracts are.

The Vulnpocalypse is Not Hyperbole

Wiz’s leadership has been calling this the coming vulnpocalypse. While that sounds like a marketing buzzword, the logic behind it is sound. We are entering an era where the barrier to entry for exploiting these legacy bugs has dropped to near zero. In the past, you needed deep technical expertise to find a zero-day in a language like PHP. Now, you just need a well-tuned AI model and a list of targets.

Attackers are using the same AI tools we use for productivity to automate the discovery of vulnerabilities. They are scanning the massive backlog of open-source libraries that haven't been updated since 2014. This is an asymmetrical war. Builders have to defend every single line of code, while an attacker only has to find one forgotten PHP script in a legacy directory to compromise the whole stack.

What This Means for Founders

If you are running a startup, you probably think you are safe because you used a modern framework. You probably didn't write a single line of PHP. But your dependencies did. Your hosting provider did. Your third-party integrations did. The tech stack is a supply chain, and right now, that supply chain is full of weak links.

The honest truth is that most founders have no idea what is actually running in their production environment. We prioritize shipping fast over auditing deeply. We pull in NPM packages like they are free samples at a grocery store. Every time we do that, we are inheriting the security debt of every developer who worked on that package over the last ten years.

The Builder's Strategy

So, how do we handle this without becoming paralyzed by fear? It starts with a shift in perspective. Security cannot be a department you hire for later; it has to be a core competency of the founding team. You need to treat your infrastructure like a liability, not an asset.

• Audit your dependencies: Use automated tools, but also use your brain. If a package hasn't been updated in years, replace it, even if it still works.
• Assume compromise: Build your systems with the assumption that a breach will happen. Segment your data. Minimize permissions. If one server falls to a PHP exploit, it shouldn't be able to talk to your primary database.
• Stop ignoring legacy tech: Just because it isn't cool doesn't mean it isn't dangerous. If you have legacy systems running in the background, kill them. The cost of migration is always lower than the cost of a total system takeover.

The biggest threat to innovation isn't a lack of funding or a crowded market; it is the fragility of the tools we take for granted.

The Skeptical Takeaway

We are obsessed with the future, but the past is what's going to kill our momentum. The PHP scare is a reminder that the 'move fast and break things' era has consequences. When you break things at the foundational level of the internet, they stay broken for a long time. The cleanup for this specific bug is going to take months, if not years, for some legacy enterprises.

For the crypto and AI community, this is a wake-up call. We are building the next financial and intellectual infrastructure of the world. We cannot afford to build it on shaky ground. If we continue to ignore the security debt of the open-source ecosystem, the 'vulnpocalypse' won't just be a headline; it will be our reality.

Don't just patch your servers. Rethink your stack. Every line of code you didn't write is a potential back door. It is time we start building like we actually care about the foundation.

Read the original at TechCrunch Startups →