Google 旗下 Wiz 的 CTO 谈 PHP2Shell 漏洞与即将到来的漏洞末日
Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
- 1支撑约 70% 网站的 PHP 上周曝出两个严重漏洞，部分机构一度将网站下线等待修复
- 2发现漏洞的研究者认为这只是开始，AI 正在改变新漏洞被发现和利用的速度
- 3Google 旗下 Wiz 的 CTO 与 OpenAI、研究组织 Calif 和 PHP 团队一同参与漏洞修复
- 4节目还讨论初创公司如何带着安全意识构建产品，以及人工打补丁为何无法规模化
AI 同时加速漏洞的发现和利用，安全防护变成修补速度的竞争，人工打补丁的流程跟不上这个节奏。
- 影响：PHP 网站存量庞大，严重漏洞出现时已有机构被迫下线停服，业务连续性风险直接可见；AI 让漏洞挖掘和利用提速，应急响应窗口变短，依赖人工的安全流程会承压。
- 参考：可考虑先盘点自家系统对 PHP 等开源组件的依赖清单并确认补丁状态；值得演练一次漏洞应急和下线恢复流程，评估哪些修补环节能用自动化工具替代人工。
- 依据：漏洞数量、约 70% 网站占比和修复协作方来自节目叙述与 Wiz CTO 一方口径；AI 加速漏洞挖掘是漏洞发现者的判断，暂无独立验证。
Loading the player…
The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities could be patched. According to researchers who found the bugs, this is only the beginning, as AI changes how quickly novel vulnerabilities can be uncovered and exploited.
On this episode of TechCrunch’sEquity podcast, Rebecca Bellan talks with Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the scramble — alongside OpenAI, research group Calif, and the PHP team — to fix the bugs. On the show, Schwartz and Bellan get into what the race looked like from the inside, how early-stage startups can build with security in mind, and why patching by hand won’t scale.
Subscribe to Equity on YouTube, Apple Podcasts, Overcast, Spotify, and all the casts. You can also follow Equity on X and Threads, at @EquityPod.
Topics
Theresa Loconsolo is an audio producer at TechCrunch focusing on Equity, the network’s flagship podcast. Before joining TechCrunch in 2022, she was one of 2 producers at a four-station conglomerate where she wrote, recorded, voiced and edited content, and engineered live performances and interviews from guests like lovelytheband. Theresa is based in New Jersey and holds a bachelors degree in Communication from Monmouth University.
You can contact or verify outreach from Theresa by emailing [email protected].
来源：TechCrunch · AI · techcrunch.com