CrowdStrike’s CEO just warned that newly discovered flaws in the software powering most of the internet will trigger a wave of break-ins, and the stock market rewarded that forecast immediately. Whether investors are buying a real threat or a vendor’s…
On Friday, October 23, 2026, CrowdStrike (NASDAQ:CRWD | CRWD Price Prediction) chief executive George Kurtz gave a television interview. He said newly disclosed flaws in PHP, the programming language behind nearly 70% of websites, will lead to a surge of break-ins. “You’re going to see a lot of breaches happening in the coming months from this,” he said, adding, “This is part of the long tail of these vulnerabilities that we see.”
Investors read the warning as a sales forecast. CrowdStrike rose $19.63, or 8.25%, to $257.57, valuing the company at $264.30 billion. Palo Alto Networks (NASDAQ:PANW) gained $25.63, or 7.22%, to $380.55.
What the PHP Flaws Actually Put at Risk
The federal cyber agency’s October 21 alert covered two critical PHP flaws, each rated 9.2 on the CVSS severity scale (a 0 to 10 danger score). Either one lets an attacker who has not logged in run code remotely on a web server, and PHP also disclosed a third remote-code-execution flaw.
The agency told operators to “Apply the patch immediately, prioritizing internet-facing systems” and to take unpatchable systems offline. Its October 23 revision reported no observed exploitation in the wild, though millions of hacking attempts followed while websites worldwide went offline as operators struggled, and SoftBank suspended its emergency alert system for mobile users.
Kurtz said tens of millions of servers are exposed and that AI-powered attacks CrowdStrike tracked doubled every month from July through September, while he put no figure on damage and named no company at risk.
Who Gets Paid When a Server Flaw Spreads
A flaw turns into revenue through emergency patching, incident response, managed detection and, eventually, platform consolidation. A long tail spreads that demand over months, so booking timing is uncertain.
CrowdStrike protects endpoints and cloud workloads, the layer closest to a compromised server, and sells incident response. Professional services revenue hit a record $71 million last quarter, a small slice of $1.47 billion in total revenue.
Palo Alto’s strength is the network. Chief executive Nikesh Arora said its firewalls can push protections for new flaws in under four hours, versus a 55-day standard patch time, which suits attacks arriving from the internet.
Okta (NASDAQ:OKTA) rose 5.82%, and Datadog (NASDAQ:DDOG) gained 4.62%, as traders bought shares across the sector.
Why a Vendor’s Warning Deserves a Discount
A security CEO forecasting breaches has a commercial interest in that forecast. Arora made the same pitch in September, predicting “some major breaches in the coming years” and calling that “a tailwind for the industry as a whole.”
Much of that story is likely priced in, because CrowdStrike is up 119.79% year to date and Palo Alto 106.6%, although CrowdStrike still closed about 10% below its $286.99 52-week high.
Palo Alto’s intraday high of $381.49 sat about 12% under its $432.33 peak. If the attempts don’t turn into confirmed breaches, investors are likely to discount further warnings, and the one-day gains may fade.
What Could Move CrowdStrike Before Its December Report
CrowdStrike’s one-day spike ran ahead of the evidence. The business is strong, with ARR of $5.84 billion growing 25%, but a forecast added 8.25% without one confirmed breach.
A TV investing club reduced its stake to 4.25% of its portfolio the same day, locking in about 187% in profits.
Palo Alto’s network layer fits server-side attacks, and it reports first, on Wednesday, November 18. It guided to revenue of $3.300 billion to $3.310 billion, non-GAAP EPS of $0.96 to $0.98, and Next-Generation Security ARR of $9.54 billion to $9.56 billion.
The trigger is a federal alert revision confirming exploitation, or PHP-linked breach disclosures, before CrowdStrike’s estimated December 1 report. Without either, CrowdStrike is likely to give back much of the $19.63.
Contact [email protected] for any questions or corrections.
Omor Ibne Ehsan is a writer at 24/7 Wall St. He is a self-taught investor with a focus on growth, cyclical, and dividend equities that have strong fundamentals, value, and long-term potential. He also has an interest in high-risk, high-reward investments such as penny stocks.
