Hundreds of websites were taken offline on Wednesday by the companies and governments that run them.
Nobody had to be attacked first…
Instead site owners were racing to close a hole before someone else found a way through it.
The hole was in PHP, a programming language that runs an estimated 70% of the world’s websites, WordPress included.
And just two PHP flaws let a stranger take over a server without a password.
Security firms Calif and Wiz found them using AI models, with Calif working alongside OpenAI.
Calif says it found the first flaw on August 1 and had a working attack ready to show PHP by August 14. OpenAI says it expects many more findings like this one…
The day before this went down, Fintech company Revolut went dark for almost 12 hours… leaving millions of people without access to their money.
Customers in several countries could not open the app or pay with their cards in shops.
Revolut said money and data were safe, and so far no losses have been reported. Yet in September, Revolut admitted that someone posing as a government agency had talked it into handing over customer data, which may have included identity documents.
Three different causes for major issues, all inside six weeks…
And I think we are at the start of this…
Meaning over the next 18 to 24 months, I expect more outages, more leaks and more sites pulled offline in a hurry.
Now for the good news…
Finding flaws used to be slow, expensive human work. Now a machine can do it in days…
And every company on the receiving end will spend what it takes to stop the next one. That budget is very hard to cut, because the alternative is what happened last Wednesday.
Meaning cybersecurity is my #1 investable industry for the next 18 months…
Which brings me to CrowdStrike.
I recommended it to Capital Gains Multiplier members on March 21, 2023…
(Which seems like a lifetime ago because neither Jasper and Ivy had been born)
The shares closed that day at $34.01 in today’s terms (CrowdStrike split its shares four for one this summer, so I have adjusted the old price). On Friday they closed at $257.57.
A $10,000 stake back then would be worth about $75,700 now.
Other cybersecurity names like Palo Alto Networks had great runs too…
And I’m still bullish…
Because in August, CrowdStrike reported a record $333 million in net new annual recurring revenue, which is the yearly value of the subscriptions it added after cancellations. That was up 51% from a year earlier.
So the company is re-accelerating even as it’s the largest it’s ever been…
It isn’t cheap, and owners should expect swings. The stock fell about 49% in 2022.
Even so, I would not sell a company at the center of this problem just because the share price has had a good run.
Oliver