Cloudflare CEO Matthew Prince has a grim forecast for the internet’s immediate future, and it isn’t about any single hack. Speaking to Reuters in an interview on Thursday, Prince said he expects a sustained run of bad news on the security front, telling the news agency he is already tracking several other serious weaknesses sitting inside widely-used software that haven’t yet made headlines. He predicted the coming months, and even years, would feel relentless as AI-assisted research increasingly drags decades-old flaws out of hiding and into the open.
Prince’s comments land at the end of a month that has genuinely tested that prediction. A critical flaw in PHP, one of the programming languages that quietly powers a huge share of the web, was disclosed and then rushed to patch after exploit code leaked online. Within hours of that disclosure, Cloudflare’s own systems recorded exploitation attempts jumping from the thousands into the millions, a pace Prince described as among the fastest he has personally observed. The flaw was serious enough that Japan’s prime minister and America’s FBI both issued public warnings urging organisations to patch immediately.
The PHP scare arrived on the heels of India’s eMudhra episode, in which a researcher found that the digital certificate authority had secured cryptographic keys with values far weaker than their supposed 256-bit strength, reportedly closer to numbers an attacker could simply guess. The fallout was swift: eMudhra’s stock hit its lower circuit and the company has since shed roughly ₹1,450 crore in market value in just two days as the scale of the compromise became clear.
Elsewhere, cloud deployment platform Railway disclosed a breach of its own and paused all customer deployments over fears that secrets may have been exposed, while Node.js shipped an emergency patch for a critical flaw in its Brotli decoder that could have allowed remote code execution, prompting Vercel to push out emergency firewall rules of its own. The cumulative effect has been loud enough that other tech executives are now describing it in similarly dramatic terms: Salesforce’s Marc Benioff and Shopify’s Tobi Lutke both weighed in on the string of incidents, with one calling it a code-red moment and the other labelling it the most chaotic stretch for cybersecurity he has seen in years.
What ties these incidents together, in Prince’s telling, is not coincidence but excavation. Large language models are getting markedly better at reading old, sprawling codebases and spotting the kind of subtle logic errors that human auditors have missed for years, sometimes decades. That means software considered stable and battle-tested, the kind of infrastructure nobody thinks to re-examine, is now being combed over by both defenders and attackers armed with the same AI tools. Prince’s view is that this is less a temporary spike than a new baseline: a long reckoning in which the internet’s older foundations get stress-tested one piece at a time.
For now, Prince says he is aware of other severe vulnerabilities sitting in critical software that have not yet become public, suggesting October’s disclosures were not an anomaly but an early preview. Whether that keeps pace with his couple-of-years timeline remains to be seen, but the pattern of the past few weeks alone gives little reason to doubt him.