The PHP flaws that sent organizations worldwide scrambling last week marks the beginning of a chaotic chapter in cybersecurity, warned Mark Weatherford, longtime CISO and current head of cybersecurity policy at AI giant Nvidia. Ultimately, things will get better, he added — but only after a stretch of unprecedented turbulence.
"PHP was like lifting the covers up," Weatherford said during a session at ISC2 Security Congress 2026, in Aurora, Colo. "The covers are going to get ripped off over the next few months, and we're going to have a bunch of PHP kind of events."
Last week, the PHP Foundation released patches for two critical flaws in PHP, the open source web scripting language used in around 70% of websites. A coalition of researchers discovered the PHP2Shell vulnerabilities using OpenAI's GPT-5.6 Sol, warning that attackers could exploit the flaws to seize control of web servers. Many experts expect the coming months will bring a tsunami of similarly serious AI-assisted vulnerability disclosures — leaving security teams racing to patch systems before AI-assisted attackers exploit them.
"We're seeing AI discover vulnerabilities that have been there for 10 or 15 or 20 years," Weatherford said. "We're going to continue to see that until our entire global codebase is rewritten."
Build a 'CISO exchange network' to navigate the AI era
As CISOs brace for a wave of PHP2Shell-scale vulnerability disclosures, Weatherford offered some practical advice for navigating the AI era as a security leader. A relatively light lift: cultivate an informal network of professional peers, what Weatherford calls a "CISO exchange network."
We're seeing AI discover vulnerabilities that have been there for 10 or 15 or 20 years. We're going to continue to see that until our entire global codebase is rewritten.
Mark Weatherford
Head of cybersecurity policy and strategic engagement, Nvidia
In Weatherford's case, that meant reaching out to CISOs at Nvidia's biggest customers and partners, such as Google, Microsoft, OpenAI and Anthropic. "I said, 'Hey, I want to know what you know, and I will tell you what I know,'" he said. "And it has been freaking amazing."
The group has a call every six months, Weatherford said, but its real value comes from off-book, ad-hoc conversations.
"'Hey, we just saw this PHP thing. What are you hearing about it?' 'We heard about this threat actor. What do you know about them?' 'Hey, have you seen this new piece of technology? What do you know about it?' Those are the kind of things that are incredibly valuable," Weatherford said.
'If you don't understand what MCP is, learn that this week'
Weatherford said many security leaders today tell him they feel they have already fallen too far behind on AI to catch up. But because the technology is evolving so quickly, Weatherford argued that anyone can now become an AI expert in very little time. Rather than trying to learn everything at once, he urged CISOs to focus on just one new topic a week.
"If you don't understand what MCP is, learn that this week. If you don't understand what prompt injections are, spend a week learning prompt injections," he said. "If you do that, at the end of the year, you're going to learn 52 new, really important things. And that separates the wheat from the chaff."
Despite his expectation that the coming months will bring a deluge of AI-driven vulnerability discoveries and disclosures — and inevitably, subsequent attacks — Weatherford described himself as an AI optimist who believes the technology will ultimately make digital environments safer.
"[My] personal opinion is the way to mitigate a lot of these AI vulnerabilities is more AI and better AI," he said. After a period of significant upheaval, Weatherford argued, "we're going to get better and better and better" at using AI to mitigate flaws and manage cyber-risk.
Alissa Irei is an Informa TechTarget senior reporter covering cybersecurity news.
