CrowdStrike shares rose 8.25% to $257.57 on Friday, Oct. 23, even as U.S. stocks declined broadly and oil prices climbed. CEO George Kurtz told CNBC that breaches linked to newly disclosed PHP vulnerabilities could increase in the coming months. His warning was a forecast, not confirmation of a breach at a named organization. Kurtz also said the flaws affected “tens of millions of internet-facing servers.”
Nearly three in four S&P 500 stocks fell, the Associated Press reported. The Dow Jones Industrial Average dropped 652.82 points, or 1.2%, to 52,215.16, while the S&P 500 lost 0.5% to 7,623.68. Brent crude settled 3.14% higher at $116.72 a barrel, and West Texas Intermediate rose 3.8% to $103.27. Reuters linked the oil gains to supply concerns following Houthi attacks in Saudi Arabia and a reported oil spill off the United Arab Emirates.
The PHP development team released updates Oct. 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The flaws could let attackers run code remotely without authentication. Patches are available for PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the project said no complete mitigation exists and updating is the only safe choice. OpenAI said Calif, using GPT-5.6 Sol, identified one flaw, while Wiz independently discovered both.
Amazon Threat Intelligence said its MadPot honeypot recorded an attempted exploit on Oct. 17, before public disclosure, and logged further attempts on Oct. 21. Amazon said it lacked evidence to determine whether the first attempts would have worked against real servers. In an assessment dated Oct. 23, CrowdStrike said its investigations had not found successful exploitation. The company also said turning proof-of-concept code into a reliable exploit is not straightforward.
PHP 8.1 and earlier no longer receive updates from the PHP project, although some Linux distributions and long-term support providers may issue backported fixes. The PHP Foundation said disagreements over how to address the flaws, its consensus-based process and limited developer resources slowed the response. It called the delay a “structural failure.”
The Federal Reserve’s next scheduled meeting is Tuesday and Wednesday, Oct. 27-28.
