Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.

How is the threat landscape looking these days? “A lot is going on,” as Adam puts it. “The speed and the volume of the activity, everything is on fire.” To illustrate, he shares the Falcon Adversary OverWatch team is now clocking a new agentic adversary every two hours.

As frontier AI accelerates exploit development, security teams need more than vulnerability severity scores to determine what demands attention. They need evidence of what can actually be exploited. In this demo, see how the CrowdStrike Exposure Validation Agent uses frontier AI to generate exploits for supported CVEs and test them in a controlled lab environment. Explore how Falcon Exposure Management evaluates exploitability conditions, documents attack prerequisites and potential impact, and provides evidence of successful exploitation.

AI agents don't stop at the answer. They read files, install packages, and run commands on the endpoint, with the user's access. AI security that only watches prompts never sees that part. This demo shows how CrowdStrike Agent Graph in CrowdStrike Falcon Guardian connects AI telemetry with Falcon endpoint telemetry to trace what agents actually do, from prompt to impact. Follow a coding agent from a routine-looking setup note to the tool call that triggered a blocked detection, see the adversary it is linked to, and catch the risky prompt in the same session.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.

Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike, recently took the stage at Fal.Con 2026 to announce CrowdStrike’s Cyber Superintelligence Lab. The lab brings together our AI researchers, offensive operators, and incident responders to build defensive model and harness capabilities for the agentic era. How are they doing it? “To build the best defense, you have to understand the best offense,” Bartley says.

Claude Code reads your developers' files and runs commands in their shell. A Social Security number pasted into a prompt or an API key in a.env file can reach the model, and a single force push can overwrite a shared branch. This demo shows how to secure Claude Code with CrowdStrike Falcon Guardian. Claude Code Hooks run a check at set points, such as when a developer submits a prompt or before a tool runs. Falcon Guardian uses those hooks to check prompts and tool calls against a central policy, deployed through Claude Code's managed settings file so developers can't override it.

Claude Code reads your developers' files and runs commands in their shell. A Social Security number pasted into a prompt or an API key in a.env file can reach the model, and a single force push can overwrite a shared branch. This demo shows how to secure Claude Code with CrowdStrike Falcon Guardian. Claude Code Hooks run a check at set points, such as when a developer submits a prompt or before a tool runs. Falcon Guardian uses those hooks to check prompts and tool calls against a central policy, deployed through Claude Code's managed settings file so developers can't override it.

With Charlotte AI AgentWorks, bring your preferred model, connect trusted tools and data through Model Context Protocol (MCP), and govern the entire agent experience from one place.

See how the Falcon Next-Gen SIEM Data Onboarding Agent simplifies the process of connecting and validating third-party security data. Using natural language, teams can identify the right connector, understand setup requirements, configure credentials, and create connections through a guided workflow.