CrowdStrike CEO Warns AI-Driven PHP Exploits as Cyber Stocks Buck Market Sell-Off

The warning came as U.S. stocks were lower Friday and this week's sell-off spread beyond technology. The Dow was down more than 1%, with defensive stocks joining a weaker AI trade, while the S&P 500 and Nasdaq were also in the red. Cybersecurity and chip stocks kept the technology sector modestly higher, and energy was the only other positive sector as oil prices surged. The club said Micron and Intel were higher.

West Texas Intermediate crude rose above $103 a barrel, and international Brent topped $116 for a six-month high, CNBC reported, citing rising tensions in the Middle East. Elevated oil prices and recently hotter government price data kept inflation fears center stage before next week's Federal Reserve meeting. The CME FedWatch tool showed just over 10% odds of a rate hike after the central bank's two-day gathering on Wednesday, and nearly 78% odds of a December increase. A December move would be the Fed's second hike in 2026, after September's first in three years. For the week, the Dow was modestly higher, while the S&P 500 and Nasdaq were modestly lower.

CNBC reported that researchers found AI could exploit security flaws in PHP, one of the most widely used server-side languages. The vulnerabilities had been known for years, but exploiting them was considered too difficult and time-consuming for hackers. AI changed that by figuring out how to break into vulnerable servers, potentially steal sensitive information and take control of websites. The discovery prompted urgent government warnings and a rush to install security fixes after details of the vulnerabilities leaked ahead of schedule.

Kurtz said: 'This affects tens of millions of internet-facing servers.' Although patches were released Wednesday, many outdated versions of PHP are still in use, and the patch almost certainly did not fix all of PHP's problems. 'You're going to see a lot of breaches happening in the coming months from this,' he warned.

Kurtz said AI-powered attacks observed by CrowdStrike doubled each month from July through September. 'It almost becomes unsustainable unless you're using defensive AI to be able to combat what the offense is doing, and that's what CrowdStrike is focused on,' he said. CNBC reported that the growing threat reinforced the Investing Club's conviction in cybersecurity as a long-term AI winner. Palo Alto Networks and CrowdStrike were the club's winners Friday and for the week.

The club said its Friday decision to trim CrowdStrike after a strong rally was strictly about right-sizing the position, not a change in confidence in the business. CrowdStrike's weighting in the portfolio had swelled to nearly 5%; the trim brought it back down to 4.25% and secured a gain of roughly 187% on stock purchased in late 2024.

Next week is the busiest of earnings season, with about a third of the S&P 500 scheduled to report quarterly results, including 11 companies in the club's portfolio, CNBC reported. Boeing reports Tuesday before the opening bell; GE Vernova Wednesday morning; Alphabet, Microsoft and FedEx Wednesday evening; Linde and Eli Lilly before Thursday's open; and Amazon, Intel, Starbucks and FedEx Freight Thursday evening.