Wiz CTO 谈 PHP2Shell 与即将到来的“漏洞大爆发”
英文标题：Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’
近日，支撑全球约 70% 网站的开源语言 PHP 曝出两项严重安全漏洞，迫使众多机构紧急排查修复甚至下线服务。安全研究人员警告称，随着 AI 大幅加快新漏洞的挖掘与利用速度，这场危机仅仅是个开端。谷歌旗下 Wiz 的应用安全与暴露管理 CTO Tomer Schwartz 参与了同 OpenAI、Calif 及 PHP 官方团队的协同修复行动。他指出，面对 AI 驱动的安全威胁，依赖人工打补丁的传统模式已无法维系，初创企业亟需从创立之初就贯彻安全设计理念。
3.1 KB
389 B
10.3 KB
53.0 KB
122.4 KB
30.0 KB
145.0 KB
248 B
45.5 KB
中文
PHP 漏洞引发的恐慌或许已从你的社交动态中淡去，但清理工作远未结束。上周，支撑全球约 70% 网站的开源语言曝出两项严重漏洞，迫使各大机构紧急排查与修复其系统，部分机构甚至在漏洞补丁上线前将网站直接下线。据发现这些漏洞的研究人员称，这仅仅是一个开端——AI 正在彻底改变新漏洞被挖掘和利用的速度。
在 TechCrunch 的 Equity 播客本期节目中，Rebecca Bellan 对话了谷歌旗下 Wiz 公司的暴露管理与应用安全（Exposure Management & AppSec）CTO Tomer Schwartz。他曾与 OpenAI、安全研究机构 Calif 以及 PHP 官方团队并肩作战，参与了那场紧张的漏洞抢修。在节目中，Schwartz 和 Bellan 深入探讨了这场竞速背后的真实内幕、早期初创团队如何将安全思维融入构建过程，以及为什么依靠人工打补丁在未来将无法规模化维系。
English / 原文
The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities could be patched. According to researchers who found the bugs, this is only the beginning, as AI changes how quickly novel vulnerabilities can be uncovered and exploited.
On this episode of TechCrunch’sEquity podcast, Rebecca Bellan talks with Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the scramble — alongside OpenAI, research group Calif, and the PHP team — to fix the bugs. On the show, Schwartz and Bellan get into what the race looked like from the inside, how early-stage startups can build with security in mind, and why patching by hand won’t scale.
Subscribe to Equity on YouTube, Apple Podcasts, Overcast, Spotify, and all the casts. You can also follow Equity on X and Threads, at @EquityPod.