Altman Says, “I No Longer Think We’re Gonna Be Able To Just Patch All The Bugs.” CrowdStrike Is Already Up 120% This Year
Sam Altman says the old way of fixing software security is finished, and a fresh wave of AI-discovered flaws just took government websites offline across three countries. Now investors are scrambling to figure out how much of that fear is…
OpenAI’s CEO, Sam Altman, says the standard approach for software security is breaking down. Gizmodo reported on Oct. 23. Altman said, “I no longer think we’re gonna be able to just patch all the bugs.” In the same period, cybersecurity stocks posted large weekly gains. CrowdStrike (NASDAQ:CRWD | CRWD Price Prediction) is up 120.03% this year through the Oct. 23 close. Investors now have to work out how much of the shift toward AI-driven security is already in the share prices.
Altman’s Warning Comes From a Company With a Stake
WION and The News International also reported on the comments, which came from a recent interview. In them, Altman said AI is finding “insane” hardware-level bugs that fall outside the normal threat model. He argued that fixing flaws one at a time can no longer keep up and that defenses need an overhaul built around AI. OpenAI has its own interest here. The company funded part of the audit that found October’s PHP flaws. Gizmodo reported that OpenAI wants to “patch the planet” with its own AI.
AI-Found PHP Flaws Took Government Sites Offline
Researchers at Wiz and Calif used AI models. According to BigGo Finance, they used OpenAI and Google models to find two critical PHP flaws in August 2026. The Calif work was part of an OpenAI-funded audit of PHP’s code, and attackers could use the flaws to take over servers, steal data, install malware or change site content. Wiz reported that the flaws affect 70% of the internet.
The PHP Foundation released a fix on Oct. 21. BigGo reported that some sites and government portals in the UK, Finland and Japan briefly went offline. Reuters reported that government websites went dark. OpenAI called the bugs “one of the most impactful vulnerabilities in recent memory,” and Moody’s reported they are being actively exploited.
Washington Urged Immediate Fixes
CNBC, as relayed by StockStory, reported that U.S. agencies including the NSA and FBI warned about the PHP vulnerabilities. They told organizations to patch right away or take vulnerable legacy systems offline, and TradingKey reported that VulnCheck finds AI has about doubled the number of vulnerabilities discovered compared with a year ago. Cloudflare (NYSE:NET) CEO Matthew Prince warned that many critical flaws in other essential software are still unpatched, which could mean several years of turbulence. TradingKey also reported that seven cybersecurity professionals expect more large-scale outages like this one.
Security Stocks Rallied as the Warnings Spread
The weekly gains came as the PHP flaws and government warnings hit. Through Oct. 23:
- CrowdStrike rose 13.4% over the past week.
- Okta (NASDAQ:OKTA) gained 13.77% for the week, including 5.82% on Oct. 23. It is up 146.39% this year.
- Palo Alto Networks (NASDAQ:PANW) climbed 11.2% for the week and 106.46% this year, ending at $380.30. StockStory reported that Palo Alto had fallen 7.8% the week before on concerns about how companies will pay for AI spending.
- Cloudflare added 9.93% for the week, including 7.31% on Oct. 23. It is up 65.22% this year.
- Zscaler (NASDAQ:ZS) jumped 22.92% for the week, though it is up just 13.34% this year.
CrowdStrike’s recent results line up with the theme. In its fiscal second quarter, net new ARR (newly added annual recurring revenue) grew 51% to $332.8M. On the earnings call, CEO George Kurtz said “you simply cannot patch vulnerabilities fast enough.”
Analysts See a Tailwind, Though Some Is Priced In
TradingKey reported that Deutsche Bank views infrastructure and cybersecurity companies, including CrowdStrike and Palo Alto, as the first to benefit from rising AI token usage. The bank also noted that valuations already reflect some of that upside, while StockStory reported that analysts view the episode as a long-term boost for security vendors.
On CrowdStrike, 10 analysts rate the stock a strong buy, 30 a buy, 12 a hold and 1 a strong sell. A price target is where an analyst expects a stock to trade in about a year. The consensus target of $247.25 sits below the recent price of $257.57. The stock also trades at about 232 times trailing earnings. That price-to-earnings ratio compares the share price with the profit the company earned over the past year.
Risks the Rally May Be Hiding
BigGo pointed out that one week of gains doesn’t guarantee higher earnings. Deutsche Bank’s comments suggest that current valuations may already account for the story. With CrowdStrike trading above its consensus target, the stock may have moved ahead of what Wall Street expects.
What to Watch Next
Keep an eye out for more AI-discovered flaws and any new government warnings. On earnings, Cloudflare is expected to report on Nov. 5, Palo Alto on Nov. 18 and Zscaler on Nov. 24. CrowdStrike’s report is expected on Dec. 1, but the company hasn’t confirmed the date. All the price figures above will change when markets reopen Monday.
Contact [email protected] for any questions or corrections.
AJ spent 10 years writing about financial markets at The Motley Fool. His coverage centers on technology stocks and the broader macroeconomic trends, from interest rates to geopolitics, that shape where markets are headed next. AJ is drawn to the stories where big-picture economics and individual companies collide.
