• George Kurtz predicts a surge in breaches from PHP2Shell vulnerabilities in the coming months.
  • Emergency patches are available, but exploitation attempts are already underway.
  • The warning highlights remediation challenges, not a breach at CrowdStrike (CRWD).

A Looming Threat

CrowdStrike CEO George Kurtz warned that a wave of cyber breaches is likely in the coming months stemming from two critical vulnerabilities in PHP, the widely used open-source scripting language that powers many websites. In an interview with CNBC (VSNT) on Friday, Kurtz said the flaws, collectively dubbed PHP2Shell, pose a significant risk because of the difficulty in patching every exposed installation. “Will see a lot of breaches in coming months from PHP vulnerability,” Kurtz said, according to a CNBC interview transcript. The warning is not related to any breach at CrowdStrike itself, but rather reflects the broad exposure of organizations relying on PHP.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21 and rated 9.2 out of 10 for severity. They allow unauthenticated attackers to execute arbitrary code on vulnerable servers. PHP released emergency fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but security researchers have already observed exploitation attempts. “Evidence differs by observer: watchTowr reported attempts but no successful exploitation on its sensors, while Hadrian described exploitation at scale,” according to a report from SecurityWeek. The mixed signals underscore the chaotic nature of the threat, with some actors moving quickly to exploit the flaws before patches are widely deployed.

Patch Gap and Active Exploitation

PHP stressed that all installations serving web requests are potentially at risk, with the highest demonstrated risk in Apache’s mod_php configuration, where code can be executed even before application code runs. The PHP Foundation also issued an additional advisory on October 23 regarding an unusual session-handling configuration, tracked as CVE-2026-115560, recommending that administrators disable session.upload_progress.enabled until the next bugfix release. While patches are available, the challenge is ensuring they are applied across the vast number of PHP installations, many of which are embedded in third-party products or run on outdated versions. The looming end-of-life for PHP 8.2 on December 31, 2026, adds urgency, as its emergency patch is only a near-term fix.

Kurtz’s warning comes as CrowdStrike continues to expand its platform. The company, which reported $5.84 billion in annual recurring revenue as of July 31, 2026, has been integrating exposure management capabilities through its agreement to acquire XM Cyber technology assets. That deal, announced in its latest earnings release, includes attack-path visualization and offensive simulation tools—precisely the kind of technology that helps organizations prioritize which vulnerabilities to patch first. “Our customers are consolidating security tools,” Kurtz said in the interview, noting that 51% of subscription customers use six or more Falcon modules. The PHP2Shell episode is unlikely to materially benefit CrowdStrike’s financials in the near term, but it reinforces the broader case for spending on exposure management and incident response.

Regulatory and International Response

Governments are already reacting. Singapore’s Cyber Security Agency updated its alert on October 23, urging immediate patching and inventories that include PHP embedded inside third-party products. The Netherlands’ NCSC is maintaining operational information covering affected products and vendor fixes, including assessments of products like Cisco (CSCO) Expressway Select Series. In the U.S., public companies must disclose material cybersecurity incidents within four business days after determining materiality, while EU entities covered by NIS2 face a 24-hour early warning and a 72-hour incident notification. These obligations could come into play if exploitation leads to qualifying breaches, though the reviewed evidence does not establish state sponsorship or attribution to any particular country.

The disclosure process itself has sparked controversy. The planned October 22 disclosure was accelerated after information leaked on October 20. SecurityWeek reported that an early demonstration video and pre-release patched images exposed details before the coordinated release, prompting criticism from the PHP Foundation. The debate centers on whether early publication helps defenders or gives attackers a head start while many users still lack deployable fixes. Jake Knott of watchTowr said he did not expect the absence of successful attempts on its sensors to last—a warning that the situation remains fluid.

What It Means for Investors and Businesses

The immediate economic exposure is operational: compromised websites can expose customer data, distribute malware, and disrupt services. No dependable aggregate loss estimate has been established. For investors, the headline supports the thesis for cybersecurity spending but should not be read as evidence that CrowdStrike owns the affected technology or that its products replace the need to patch PHP. CrowdStrike’s stock was little changed in premarket trading following the interview, as the market digested the broader implications.

Smaller organizations with limited inventories or outsourced hosting may struggle to determine whether PHP is present at all. The vulnerabilities involve PHP’s core memory management and request cleanup, and one underlying out-of-memory weakness had been identified years earlier but its full remote-execution implications only became clear through research reported in August 2026. As Kurtz’s forecast suggests, the coming months will test how quickly and thoroughly organizations can close the patch gap. Administrators need not only to update but also to investigate whether exposed systems were accessed before remediation—installing a patch alone does not establish that a previously compromised server is clean.

Correction: An earlier version of this article misstated the date of the CNBC interview. It took place on Friday, October 23, 2026, not Thursday.