AI will outpace patching. Your audit can't wait.

The CEOs of Salesforce and Cloudflare, plus Anthropic's deputy CISO, all said publicly this week that AI will produce more security vulnerabilities than the security community can patch. If three executives at that level are saying the sky is falling, the right move isn't to wait and see whether they're right. It's to audit your internet-facing infrastructure before someone else finds your holes first.

The trigger was what's now being called 'Black October.' The Guardian reported that on October 21, researchers using AI identified critical flaws in PHP — the coding language that runs across millions of websites. Researchers at AI security platform Wiz called the vulnerabilities 'among the most severe vulnerabilities discovered in PHP, and arguably in software history,' and said the underlying flaws had been present for decades. The catch: finding them 'required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.' AI got there anyway.

The NSA issued an alert recommending any site running PHP apply patches immediately, warning that malicious actors could use the flaws to 'steal sensitive data, disrupt services or move deeper into a network.' Government and private websites across the US and UK took themselves offline to patch. And exploitation attempts didn't wait for anyone to get ready. Cloudflare CEO Matthew Prince wrote on X that his company had already seen thousands of people probing the PHP flaws in the ten hours before the announcement. Forty-five minutes after it went public, that number jumped to tens of thousands. Within two hours: hundreds of thousands. Then millions.

What the executives actually said

This isn't a single alarmist voice. Prince wrote that 'the next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet.' He said it's 'going to feel like the sky is falling.' Jason Clinton, Anthropic's deputy CISO, predicted a 'vulnerability tsunami' in the coming months and said flatly: 'There won't be enough time to patch critical infrastructure.' Sam Altman joined Thursday evening with his own statement: 'I no longer think we're going to be able to patch all bugs.' Marc Benioff, Salesforce's CEO, called the situation a 'code red.'

These aren't researchers at a conference. They run companies whose entire business model depends on people trusting software. When they say the math no longer works in defenders' favor, that's worth taking at face value.

Why this is different from the usual doom cycle

Cybersecurity has a long tradition of apocalyptic warnings that don't quite land. So here's the fair version of the skeptic's case: executives have incentives to talk up threats — it sells security products, generates press, and positions their platforms as essential infrastructure. 'Vulnerability tsunami' is a phrase designed to travel on X. Some of the most alarming figures, like the estimate that 70% of all sites on the internet were at risk from the PHP flaws, come from unnamed experts without a stated methodology.

Fair enough. But the skeptic's case doesn't actually change the calculus much. The PHP event happened. The exploitation attempts happened — and Cloudflare's data on the speed of that escalation is specific and striking. The Wiz researchers' point is the one that should keep you up at night: AI found flaws that were decades old and that human researchers could barely demonstrate were exploitable at all. That's a qualitative shift, not just a faster version of the same old threat. The argument that executives are hyping the risk doesn't mean the risk isn't real. It means you should verify your own exposure rather than take anyone's word for it.

Cybersecurity experts had been warning about a so-called 'vulnpocalypse' for months before Black October. The PHP event is the first time those warnings came with a concrete, named incident, an NSA alert, and government sites going dark to patch. That's a different kind of signal.

What to do Monday morning

Three things worth doing before this week is out.

• Find out if you run PHP anywhere. Ask your CTO or infrastructure lead today. If the answer is yes, confirm that patches were applied after October 21. Don't assume someone handled it.
• Ask your security vendor what their AI-assisted scanning posture looks like. If they're not already using AI to find your vulnerabilities before attackers do, ask when they plan to. The asymmetry Prince described — AI with infinite patience scanning the entire internet — means reactive patching is no longer a viable strategy on its own.
• Review your incident response plan for a scenario where multiple critical vulnerabilities appear simultaneously. The 'tsunami' framing is the point: it's not one CVE you can queue up and fix. It's the possibility of dozens arriving faster than your team can triage them. If your plan assumes a manageable drip of patches, it may need updating.

The deeper question isn't whether Black October was as bad as the worst predictions. Some experts estimated 70% of all sites were at risk — that figure is unverified, and it's possible the actual damage ends up contained. What matters is the mechanism: AI found something humans couldn't, attackers moved within minutes, and the executives who run the infrastructure the internet depends on are saying publicly that this is the new normal.

Watch whether the next major vulnerability disclosure follows the same escalation pattern Prince described. If it does — thousands of probes before announcement, millions within hours — then the 'vulnerability tsunami' framing will look less like executive theater and more like an accurate description of what your security team is now up against. My bet is we'll know within the next six months.