When 70% of the web was exposed

On 21 October 2026, PHP’s maintainers released emergency patches for two critical flaws in the engine that runs roughly 70% of the world’s websites. At the center of the response was Wiz Research, the team behind cloud security leader Wiz, led by CEO and co-founder Assaf Rappaport, winner of Cloud Innovator of the Year at The Cloud Awards 2023-2024.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and christened “PHP2Shell” by Wiz, are memory-safety bugs affecting PHP versions 5.4 to 8.5. Both carry a critical CVSS v4.0 score of 9.2. Exploited, they let an attacker with no login run code on a server and read passwords, tokens and API keys from memory. Because the weakness sits in PHP itself, sites built on WordPress, Drupal and Joomla were exposed even when their own code was flawless.

Wiz Research found its first vulnerability on 19 August and reported its findings to the PHP security team on 24 August. Security firm Calif, working within OpenAI’s “Patch the Planet” initiative, had independently found the first flaw on 1 August, and the organizations then worked with PHP’s maintainers on coordination and patch verification. Wiz demonstrated working attacks against the latest WordPress, Drupal and Joomla releases, used AI to help validate the fix, and partnered with Google Cloud, Cloudflare, AWS, Microsoft and others to prepare detections and mitigations for organizations that could not patch straight away.

Wiz’s researchers have compared PHP2Shell to Heartbleed, the 2014 OpenSSL bug that shook confidence in the internet’s shared foundations. What sets PHP2Shell apart is how it was found: with frontier AI.

The leader behind the response

A research team capable of finding, proving and responsibly disclosing a flaw of this scale does not appear by accident. It reflects the company Assaf Rappaport has spent nearly seven years building.

Rappaport’s grounding in security began in military service, through Israel’s elite Talpiot programme and then as a captain in Unit 8200. There he met Ami Luttwak, Roy Reznik and Yinon Costica, the team he would go on to found two companies with. After a spell at McKinsey, he co-founded cloud access security broker Adallom in 2012. Microsoft acquired it in 2015 for more than $300 million, and at 34 Rappaport was appointed head of Microsoft’s Israel R&D center, overseeing roughly 1,500 people and leading its cloud security group.

In January 2020 he left to co-found Wiz with the same partners. The idea was simple and ambitious: one platform that could see and assess risk across every major cloud, without the burden of installing agents on every workload. Wiz emerged from stealth in December 2020 with a $100 million Series A, reportedly reached $100 million in annual recurring revenue within about 18 months, and by 2023 was reported to serve more than 40% of the Fortune 100. A $1 billion round in May 2024 valued the company at $12 billion.

Alongside the product, Wiz built Wiz Research into a public-facing team. Its work on earlier crises, such as measuring the reach of Log4Shell across enterprise cloud environments, built the credibility that made Wiz a natural partner when PHP2Shell surfaced.

Cloud Innovator of the Year

Wiz Co-Founders Assaf Rappaport, Ami Luttwak, Yinon Costica and Roy Reznik. Rappaport won the 2023-24 Cloud Award for Cloud Innovator of the Year.

The Cloud Awards judging panel recognized that trajectory early. In the 2023-2024 programme, Rappaport was named Cloud Innovator of the Year, ahead of finalists CData and Dig Security. Cloud Awards judge Ankur Gupta explained the decision:

“Assaf Rappaport’s leadership at Wiz sets a new standard for innovation. The Wiz Security Graph and agentless approach redefine cloud security, providing unmatched visibility and risk prioritization. Wiz’s rapid innovation, from breach prevention to multi-cloud expansion, showcases a commitment to staying ahead of threats. Assaf Rappaport’s transformative contributions position Wiz as an industry leader, reshaping how organizations secure their cloud environments. Congratulations, from everyone at The Cloud Awards!”

Three years on, PHP2Shell reads like a field test of that assessment. When a flaw lives in a runtime as widespread as PHP, the first question every security team asks is where they are exposed. Visibility across the whole estate and the ability to prioritize what to fix first are exactly the strengths the judges singled out. And “staying ahead of threats” took on a literal meaning: Wiz and its fellow researchers found the bugs and spent two months working confidentially with PHP’s maintainers and industry partners so that fixes and mitigations were ready on disclosure day.

From award winner to Google’s biggest deal

The Cloud Awards announced Rappaport’s win in December 2023. What followed was one of the most remarkable runs in the history of enterprise software.

By mid-2024, reports emerged that Google was interested in acquiring Wiz. Wiz turned down an offer of around $23 billion to keep its IPO options open, but talks resumed, and on 18 March 2025 Google agreed to buy the company for $32 billion in cash. After a 12-month regulatory review, with unconditional clearance from authorities including the US and the European Commission, the deal closed on 11 March 2026. It is the largest acquisition in Google’s history and the largest exit Israel’s tech sector has ever seen. Wiz has joined Google Cloud while continuing to serve customers across multiple clouds. Rappaport said that becoming part of Google Cloud was “effectively strapping a rocket to our backs.”

No single award makes a $32 billion company. But independent, expert validation is part of the story that growing businesses tell customers, investors and potential acquirers, and Wiz’s Cloud Award arrived at the start of the momentum that carried it to Google. It marked Wiz out, in front of a global audience, as the innovator to watch at precisely the moment the market’s biggest players were paying attention.

Wiz is not the only winner from that program to catch a buyer’s eye. Couchbase, which took Best Cloud Data Management Solution in 2023-2024, agreed to be acquired by Haveli Investments in June 2025, in an all-cash deal valued at around $1.5 billion that completed that September. For ambitious cloud companies, a Cloud Award has a track record of keeping very good company.

Security in the AI era

PHP2Shell may be remembered less for its scale than for what it revealed about the new balance of power in cybersecurity.

The vulnerable code had been sitting in PHP since version 5.4 was released in 2012. Concerns about this class of memory-safety bug were not new, but little was done because a working exploit was thought impractical. Wiz Research changed that by pairing its own AI vulnerability researcher, Wiz Atlas, with frontier models Gemini 4 Argon and GPT-5.6 Sol. According to Wiz, the models helped find the flaws, develop the exploit, detect attacks and validate the patch, and one researcher did in about a week work that would previously have taken an expert team months. Wiz describes PHP2Shell as an AI inflection point: AI is changing which long-standing weaknesses can actually be exploited.

That cuts both ways. The same capabilities are available to attackers, and the gap between disclosure and attack is collapsing. Details of PHP2Shell leaked online before the patches shipped, Amazon spotted an exploitation attempt four days before public disclosure, and Cloudflare saw attempts climb into the millions within about 12 hours of the announcement. Organizations that once had weeks to patch now have days, sometimes hours.

Published vulnerabilities were climbing well before generative AI arrived, as more organisations began issuing CVE IDs. The sharp break came in 2026: monthly publications rose every month from April to September, as AI-assisted bug hunting scaled up alongside cleared backlogs and a fast-growing software ecosystem.

Yet the opportunity is just as large. If AI can surface decade-old flaws in about a week, defenders can hunt through the world’s critical software before criminals do. PHP2Shell also showed a new model of response: rival AI labs and security firms working side by side with open-source maintainers, under coordinated disclosure, to fix a problem that touched most of the web. It is exactly the kind of applied AI innovation that The A.I. Awards exist to recognize.

For security leaders, the lessons are clear. Know exactly what runs where across every cloud. Prioritise ruthlessly, because AI-assisted attackers will. And treat AI as an essential part of the defensive toolkit, not an optional extra. Those are the qualities The Cloud Awards recognized in Assaf Rappaport and Wiz in 2023, and the qualities our judges look for in every entry to The Security Awards. They have never mattered more.