Squawk on the Street · Oct 24, 2026
With George Kurtz, CEO and Founder, CrowdStrike
Tens of millions of internet-facing servers carry a PHP interpreter flaw that has existed for close to 20 years, CrowdStrike CEO and founder George Kurtz told CNBC. Most of the coverage has treated the bug as old news; George says artificial intelligence is the only reason it suddenly needs a patch window measured in hours.
"You need to be looking at your watch, not a calendar, when you're thinking about patching this. It is that critical at the moment."
George built CrowdStrike into one of the largest cybersecurity companies selling directly into the customer base now getting that patch order, which is why his read on how fast this is moving carries weight.
The full segment is covered here so you can skip it.
Here are the 3 takeaways that matter.
Key Takeaways
The PHP interpreter flaw already reaches tens of millions of internet-facing servers worldwide
AI has turned exploiting the bug from theoretical into something George says it has now proven works
CrowdStrike is telling customers to patch in hours, not weeks
Old routers and firewalls form a long tail of devices that will never be patched
George expects a steady run of breaches in the coming months tied to this flaw
AI is democratizing who can carry out a nation-state-level attack
Low-skill adversary groups can now reach that level for the cost of tokens and a prompt
1. AI made the exploit real
The PHP flaw making headlines isn't new, George told CNBC co-anchor Sara Eisen: it's a cluster of bugs in the PHP interpreter that have existed for close to 20 years. What changed, he said, is that AI has proven the flaw can actually be exploited at scale, not just in theory.
The flaw already touches tens of millions of servers
"This affects tens of millions of internet-facing servers." — George
PHP runs across a large share of the open internet, powering countless websites and the servers behind them. George said the flaw turned urgent for one reason: AI moved it from a theoretical weakness to a proven one.
Patch in hours, not weeks, George says
"You need to be looking at your watch, not a calendar, when you're thinking about patching this. It is that critical at the moment." — George
CrowdStrike is telling every customer to compress its patch window from the usual weeks down to hours. Before this, George said, it was only a theoretical risk that security teams could reasonably put off.
