October has turned into one of the roughest stretches the software industry has seen in years, and two of the world’s most prominent tech CEOs are now saying so publicly, in increasingly alarmed terms.
Salesforce CEO Marc Benioff posted on X on Friday morning, responding to a thread from security researcher Jason D. Clinton, with a blunt two-word verdict: “Jason is 100% right. Code red.” Clinton’s original post warned that “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,” and urged security leaders to use the moment to go to their boards and ask for help — “not for AI, for the basics” — adding that organizations need to “hold on for ~18 months.”
A day earlier, Shopify CEO Tobi Lutke had already flagged the scale of what was unfolding, reposting a tally of vulnerabilities disclosed in a single day — 2 CVEs in PHP, 10 in Node.js, 5 in NGINX, among others — with the comment: “Craziest day in cyber security in a long time.”
Between them, the two founders have put a name to what engineering and security teams have been living through all week: a pileup of critical disclosures across some of the internet’s most foundational software, hitting companies in rapid succession.
A week that started with a single PHP flaw #
The chain of events traces back to a critical PHP vulnerability that the PHP Foundation had to patch on an emergency basis after exploit details leaked online. Given how much of the web still runs on PHP, the flaw set off an immediate scramble. Cloudflare CEO Matthew Prince later shared data showing exploit attempts against the bug jumped from thousands to millions within hours of disclosure, underlining how fast attackers moved once the details were public.
The severity was enough that it wasn’t just companies reacting — government agencies got involved too, with Japan’s Prime Minister and the US FBI both posting public warnings urging people to patch their systems.
OpenAI, notably, says its own models helped limit the damage: the company has said its GPT-5.6 Sol model played a role in flagging one of the two critical PHP bugs that triggered the scramble in the first place — an early, real-world data point for AI-assisted vulnerability discovery landing in the middle of an active crisis.
Then came eMudhra, Railway, and Node.js #
PHP wasn’t the only front. Indian digital security firm eMudhra, the country’s largest licensed certificate authority, found itself at the center of its own scare after a certificate key compromise came to light, reportedly traced to a basic flaw in how its key material was generated. Online speculation grew over whether the company had mistaken 256-bit keys for numbers between 0 and 256, a theory that spread quickly as engineers tried to make sense of how a certificate authority could get key generation so wrong.
Markets reacted fast: eMudhra’s stock hit a 20% lower circuit in the immediate aftermath, and within two days the company had shed roughly ₹1,450 crore in market capitalization.
As if that weren’t enough for one week, cloud deployment platform Railway disclosed a security breach of its own and d all deployments after customer secrets may have been exposed. And Node.js — the runtime underpinning a huge share of modern backend infrastructure — shipped patches for a critical Brotli decoder flaw that could allow remote code execution, serious enough that Vercel rushed out emergency firewall rules of its own.
Lutke’s “craziest day” post captured exactly this pileup: PHP, Node.js and NGINX all disclosing serious vulnerabilities within the same 24-hour window, on top of an active certificate authority breach and a cloud platform incident still being worked through.
“Not for AI, for the basics” #
What makes Clinton’s warning — and Benioff’s endorsement of it — notable is the specific framing. Clinton, who is Anthropic’s Deputy CISO, wasn’t asking security leaders to go to their boards for more AI tooling or bigger budgets for flashy new defenses. He was asking them to ask for help with fundamentals: patching discipline, key management, incident response capacity — the unglamorous groundwork that this week’s incidents suggest has been under-resourced across the industry. His estimate that organizations need to “hold on for ~18 months” suggests he sees this week less as an isolated spike than as the opening stretch of a longer, harder cycle.
Benioff’s “code red” response carries weight given Salesforce’s position as one of the largest enterprise software vendors in the world, with direct exposure to exactly the kind of infrastructure-level risk this week has exposed. Combined with Lutke’s characterization of the day as the “craziest” he’s seen in cybersecurity in a long time, the back-to-back posts from two major CEOs have turned what might otherwise have been read as a string of disconnected incidents into something being talked about as a singular, industry-wide moment — the kind of week that tends to get a name in hindsight. “Black October” may well be it.