Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.

How is the threat landscape looking these days? “A lot is going on,” as Adam puts it. “The speed and the volume of the activity, everything is on fire.” To illustrate, he shares the Falcon Adversary OverWatch team is now clocking a new agentic adversary every two hours.

As frontier AI accelerates exploit development, security teams need more than vulnerability severity scores to determine what demands attention. They need evidence of what can actually be exploited. In this demo, see how the CrowdStrike Exposure Validation Agent uses frontier AI to generate exploits for supported CVEs and test them in a controlled lab environment. Explore how Falcon Exposure Management evaluates exploitability conditions, documents attack prerequisites and potential impact, and provides evidence of successful exploitation.

AI agents don't stop at the answer. They read files, install packages, and run commands on the endpoint, with the user's access. AI security that only watches prompts never sees that part. This demo shows how CrowdStrike Agent Graph in CrowdStrike Falcon Guardian connects AI telemetry with Falcon endpoint telemetry to trace what agents actually do, from prompt to impact. Follow a coding agent from a routine-looking setup note to the tool call that triggered a blocked detection, see the adversary it is linked to, and catch the risky prompt in the same session.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.

Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike, recently took the stage at Fal.Con 2026 to announce CrowdStrike’s Cyber Superintelligence Lab. The lab brings together our AI researchers, offensive operators, and incident responders to build defensive model and harness capabilities for the agentic era. How are they doing it? “To build the best defense, you have to understand the best offense,” Bartley says.

Claude Code reads your developers' files and runs commands in their shell. A Social Security number pasted into a prompt or an API key in a.env file can reach the model, and a single force push can overwrite a shared branch. This demo shows how to secure Claude Code with CrowdStrike Falcon Guardian. Claude Code Hooks run a check at set points, such as when a developer submits a prompt or before a tool runs. Falcon Guardian uses those hooks to check prompts and tool calls against a central policy, deployed through Claude Code's managed settings file so developers can't override it.

Claude Code reads your developers' files and runs commands in their shell. A Social Security number pasted into a prompt or an API key in a.env file can reach the model, and a single force push can overwrite a shared branch. This demo shows how to secure Claude Code with CrowdStrike Falcon Guardian. Claude Code Hooks run a check at set points, such as when a developer submits a prompt or before a tool runs. Falcon Guardian uses those hooks to check prompts and tool calls against a central policy, deployed through Claude Code's managed settings file so developers can't override it.

With Charlotte AI AgentWorks, bring your preferred model, connect trusted tools and data through Model Context Protocol (MCP), and govern the entire agent experience from one place.

See how the Falcon Next-Gen SIEM Data Onboarding Agent simplifies the process of connecting and validating third-party security data. Using natural language, teams can identify the right connector, understand setup requirements, configure credentials, and create connections through a guided workflow.

When attackers compromise internet-facing devices, they may use them to access internal services and move laterally through the environment. Falcon Next-Gen Identity Security helps identify and stop this activity with dedicated detection and prevention for connections originating from classified internet-facing devices. With conditional access and automated response, organizations can block suspicious access, disable compromised users, and contain threats before they spread.

Proactive security starts with understanding the environment before an attacker can take advantage of it. In this demo, see how the CrowdStrike Falcon platform brings together proactive telemetry and context across endpoint, cloud, identity, network, applications, SaaS, and more to build a connected view of risk.

See CrowdStrike Falcon Data Security for SaaS in action and learn how to discover, classify, and protect sensitive data across Microsoft 365. See how security teams can identify sensitive data in SharePoint and OneDrive, prioritize exposure, automatically apply Microsoft Sensitivity Labels, reduce unintended Microsoft Copilot exposure, and extend protection with just-in-time access.

CrowdStrike's Falcon for XIoT addresses challenges in managing complex industrial and clinical environments by providing visibility into operational assets. The solution helps teams prioritize vulnerabilities based on operational impact rather than severity alone, ensuring safe decisions while minimizing interruptions. Through a detailed investigation process, users can assess asset profiles, validate exposures, and implement controlled responses tailored to specific risks. This approach optimizes asset management and enhances safety in both operational technology (OT) and clinical settings.

Adversaries are targeting the browser — hijacking sessions, stealing credentials, and exploiting gaps traditional tools can’t see.