Wiz 首席技术官警告：互联网老旧代码即将迎来“漏洞末日”（Vulnpocalypse）

英文标题：The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO

近期，支撑全球约 70% 网站的开源语言 PHP 曝出两处严重漏洞，引发行业紧急排查与修复，部分站点甚至被迫临时下线。安全研究人员指出，在 AI 大幅加速新漏洞挖掘与利用的背景下，此类针对老旧代码库的攻击才刚刚拉开序幕。Wiz 高管透露，若非借助定制化 AI 工具在一个周末内快速验证数十种假设，团队根本无法发现潜藏十余年的深层漏洞。这也表明传统的人工修复模式已无法应对未来的自动化安全威胁，整个互联网基础设施需重新审视安全防护策略。

打开原文相关 2 · 机会 2

中文

PHP 漏洞引发的恐慌可能已经从你的信息流中淡去，但善后修复工作远未结束。近期，这项支撑着全球约 70% 网站的开源语言曝出两处严重漏洞，让各家企业机构手忙脚乱地抢修系统，部分组织甚至不得不将网站暂时下线，直至漏洞补丁完成部署。发现这些漏洞的研究人员警告称，这仅仅是一个开端——AI 正在根本性地改变未知新型漏洞被挖掘与利用的速度。

在 TechCrunch 旗下 Equity 播客的最新一期节目中，Rebecca Bellan 与 Google 旗下 Wiz 暴露管理与应用安全（AppSec）首席技术官 Tomer Schwartz 展开了深入探讨。此前，Schwartz 与 OpenAI、安全研究机构 Calif 以及 PHP 核心团队一起参与了这场紧急的漏洞修复行动。在节目中，Schwartz 与 Bellan 详细还原了这场内部紧急竞速的始末，探讨了早期初创公司应如何在设计之初就融入安全思维，以及为何单纯依靠人工打补丁的方式已经难以为继。

收听本期播客完整内容，深入了解以下要点：

为何 Tomer 表示如果脱离 AI，Wiz 根本无法发现这些漏洞；以及定制工具如何在一个周末内迅速验证数十种假设想法。
一个安全隐患为何能在众目睽睽之下潜伏十多年，究竟是哪些环境与机制的变化使其最终演变成可被利用的严重漏洞。
为何在多方协同披露（Coordinated Disclosure）流程中信息泄漏几乎在所难免，以及 Wiz 如何提前为此制定应对预案。
目前哪些系统仍处于未修复状态，以及运行 WordPress 网站的小微企业主是否需要为此感到担忧。

English / 原文

The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities could be patched. According to researchers who found the bugs, this is only the beginning, as AI changes how quickly novel vulnerabilities can be uncovered and exploited.

On this episode of TechCrunch’s Equity podcast, Rebecca Bellan talks with Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, who was part of the scramble — alongside OpenAI, research group Calif, and the PHP team — to fix the bugs. On the show, Schwartz and Bellan get into what the race looked like from the inside, how early-stage startups can build with security in mind, and why patching by hand won’t scale.

Listen to the full episode to hear more about:

Why Tomer says Wiz couldn’t have found these bugs without AI, and how custom tooling tested dozens of ideas over a weekend.
How a bug was able to sit in plain sight for more than a decade, and what changed to make it exploitable.
Why leaks are almost baked into coordinated disclosure, and how Wiz planned for it.
Who’s still unpatched and whether small business owners running WordPress sites need to worry.

Subscribe to Equity on YouTube, Apple Podcasts, Overcast, Spotify, and all the casts. You can also follow Equity on X and Threads, at @EquityPod.