The StockAnalysis quote screen for CrowdStrike (CRWD), timestamped 23 October 2026 at 4:00 p.m. Eastern, showed a last sale of $257.57, up $19.63, or 8.25%, from the prior close of $237.94. The same payload had an after-hours print of $258.40, up $0.83, or 0.32%, at 7:59 p.m. Eastern. We pulled that quote from the equity endpoint, and the daily bars below from the history page, on 26 October 2026, before the next US cash open.
The six sessions that frame Friday's close are these. The change column is the figure stored on each bar.
| Session | Close | Change | Volume |
|---|---|---|---|
| 16 October | $227.39 | -7.02% | 13,859,677 |
| 19 October | $228.10 | +0.31% | 8,325,183 |
| 20 October | $227.37 | -0.32% | 8,029,711 |
| 21 October | $239.34 | +5.26% | 9,396,652 |
| 22 October | $237.94 | -0.58% | 10,096,529 |
| 23 October | $257.57 | +8.25% | 13,400,055 |
Friday's bar opened at $239.29, traded as high as $257.91 and as low as $234.79, and closed 34 cents under the high. The open sat 0.57% above Thursday's close, and the low then traded through that prior close before the stock recovered 9.70% from the low to the finish. Volume of 13,400,055 shares was the heaviest of the six sessions, in line with the 13,859,677 shares on the 16 October drop.
Friday repaired the mid-month slide and left the prior peak intact. The 6 October bar closed at $278.86 after trading at $286.99, the 52-week high on the quote payload. From that close to the 16 October close of $227.39 the share fell 18.46%, then rose 13.27% into Friday, which still sat 7.63% under the 6 October close and 10.25%, or $29.42, under the high. The overview's average target of $247.25, from 53 analysts, sat $10.32 under the close and was marked 4.01% under the latest price. A rising session left the price on the expensive side of the published average, with a mix of 30 strong buys, 10 buys, 12 holds, one sell and a strong-sell count of zero.
The overview stores reference prices beside the quote and attributes them to Polygon. Against Friday's $257.57 the share stood 3.0% above the one-month price of $250.06, 36.7% above the three-month price of $188.42, 120.8% above the six-month price of $116.67, 119.8% above the year-to-date price of $117.19, and 106.0% above the one-year price of $125.028. Daily bars on the history page run from a 23 April close of $111.348 through Friday, a six-month window and a rise of 131.3% on our arithmetic. The one-year comparison uses that single overview price, because the history screen served the six-month series when we opened it.
What resellers told Evercore
The catalyst the wires attached to Friday was an Evercore ISI quarterly survey of cybersecurity channel partners. Evercore's own note stayed off the open pages. What we opened on 26 October were two secondary accounts dated 23 October, written while the stock was still trading, so their percentages sit under the official close.
A TIKR report by Gian Estrada had Palo Alto Networks up 6.5%, CrowdStrike 6.7%, Okta 5%, Cloudflare 6% and Zscaler 4%, after the survey found security budgets getting stronger. Partners described firmer year-end budgets, healthy pipelines and spending on data, AI, identity and cloud. Okta had the strongest pipeline momentum of any vendor surveyed. Those TIKR percentages were taken intraday.
TIKR dated the group move to Wednesday, when the PHP flaws were disclosed, and reported that Palo Alto chief executive Nikesh Arora told the TBPN podcast that afternoon that more such flaws were coming. The bars match that order, with the rise on 21 October, the dip on 22 October and the bulk of the recovery on Friday.
A GuruFocus item by Renato Neves, carried on Yahoo Finance, had CrowdStrike up 5.87% as of 1:20 p.m. Eastern. It named CrowdStrike and Palo Alto as the leading beneficiaries of AI-driven security spending, Partners ranked identity protection, AI governance and cloud security first, tied in that piece to Falcon. The 8.25% official close landed above that 5.87% reading and above TIKR's 6.7%. Yahoo also says Mizuho raised its target to $275 from $250 on Thursday and kept Outperform, citing Falcon Guardian, and the StockAnalysis news list attributes the same change to TheFly on 22 October 2026. At the close, $275 sat 6.8% above the print.
A broker comment moving a large software name ahead of a new filing is a familiar tape. On this desk, Salesforce rose 2.09% after a BofA double upgrade. For CrowdStrike stock, the comment arrived after the 18.46% slide from the early-October close.
Two CrowdStrike posts on the same day
On 21 October the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory on php.net describes two flaws that can allow unauthenticated remote code execution. CVE-2026-109618 can interrupt PHP during an out-of-memory condition while internal request data is only partly initialised. CVE-2026-109619 can leave request-owned state in place after its memory has been freed, so a later request on the same worker may use it. PHP said the risk looked highest for mod_php. An earlier notice rated both issues CVSS v4.0 9.2. PHP 8.2 reaches end of life on 31 December 2026.
Amit Serper's 21 October post describes the same pair, repeating the CVSS 4.0 score of 9.2 and a classification of CWE-824. CrowdStrike wrote that it had verified a single anonymous POST can make an Apache mod_php worker launch a shell and run an attacker-specified command, with authentication, a session and a vulnerable application all absent from the path. The worker stays up and can return HTTP 200.
On Friday, Jaime Duque and Brenden Conrad posted on the obstacles to weaponising PHP2Shell. They wrote that PHP powers approximately 70% of websites, citing W3Techs, and that Counter Adversary Operations had seen testing, probing and unsuccessful attempts, with the proofs of concept largely crash-only. The same post says the team did reproduce remote code execution with the privileges of the mod_php or PHP-FPM worker. A reliable exploit, they argued, has to match the PHP version and the application in front of it.
CrowdStrike's account on X put that research in front of readers on Friday evening. The 22:48 GMT post points at the obstacles note and asks why widespread exploitation remains unconfirmed.
CrowdStrike Intelligence has reproduced variants of remote code execution (RCE) tied to PHP2Shell.
— CrowdStrike (@CrowdStrike) October 23, 2026
Why hasn't widespread exploitation been confirmed?
Our researchers explain the technical obstacles and what organizations should know: https://t.co/pgcxzsTgFa pic.twitter.com/5xwfKC9YA4
A briefing page cites about 275,000 IP addresses on vulnerable PHP and exploit attempts in the millions, footnoted to Falcon Exposure Management, with sessions on 28 October in the Americas and Europe and 29 October in JAPAC. That is a wider claim than the Friday post. The same day's PHP archive entry, on CVE-2026-115560, asks administrators to keep session upload progress disabled until the next bugfix. PHP said the path needs the session handler switched from php_binary or php_serialize to php before session_start, and called that setup unlikely.
The multiple in front of the December print
The figures we opened are the fiscal second quarter of 2027, ended 31 July 2026, in exhibit 99.1 to the 8-K of 26 August. The SEC submissions list for CIK 0001535527 shows that 8-K, a 10-Q the next day for the period ended 31 July, and then Forms 4 and 144. Later earnings releases are absent from that recent list.
Revenue was $1.47 billion, up 26% from $1.17 billion. Subscription revenue was $1.40 billion, up 27% from $1.10 billion. ARR grew 25% to $5.84 billion as of 31 July, including $332.8 million of net new ARR, which the headline rounds to a record $333 million and calls 51% growth. GAAP net income was $5.3 million, or $0.01 diluted, against a loss of $70.2 million. Non-GAAP net income was $322.9 million, or $0.31 diluted, against $237.4 million, and free cash flow was $377.4 million, against $283.6 million.
George Kurtz, founder and chief executive, said in that release that the company was raising its full-year fiscal 2027 net new ARR growth outlook by 630 basis points. Burt Podbere, chief financial officer, put the raised midpoint at 34%. That midpoint is still the guidance on the filing record.
The StockAnalysis overview, retrieved 26 October, showed a market capitalisation of $264.30 billion, trailing revenue of $5.40 billion, earnings per share of $0.04, a trailing price-to-earnings ratio of 6,987.03 and a forward ratio of 182.32. On our arithmetic that value is 48.9 times trailing revenue and 45.3 times July ARR. GAAP net income is 0.36% of the quarter's revenue, and non-GAAP net income is 22.0% of it.
The screen's estimated next earnings date is 1 December 2026. Reading a print line by line, the approach in the Lam Research earnings comparison, means watching subscription growth, net new ARR against the 34% midpoint, and the GAAP to non-GAAP gap, even where the products differ. Palantir's 7% drop in a software selloff is a recent example on this desk of a multiple being marked down. Fiscal 2026 revenue on the overview was $4.81 billion, up 21.71% from $3.95 billion, with a loss of $162.50 million, and the fiscal year ends 31 January, so that year precedes the July quarter.
RelatedCaterpillar (CAT) vs Deere (DE) on the Equipment Cycle
| Measure | Figure | Where it comes from |
|---|---|---|
| Close, 23 October | $257.57, +8.25% | StockAnalysis quote, 4:00 p.m. Eastern |
| 52-week high and low | $286.99 and $85.68 | Same quote payload |
| Market cap and trailing revenue | $264.30 billion and $5.40 billion | StockAnalysis overview, retrieved 26 October |
| Forward P/E and average target | 182.32 and $247.25 | Same overview, 53 analysts |
| ARR at 31 July | $5.84 billion, up 25% | Exhibit 99.1, filed 26 August 2026 |
| Q2 FY2027 revenue | $1.47 billion, up 26% | Same exhibit |
| Q2 GAAP and non-GAAP net income | $5.3 million and $322.9 million | Same exhibit |
What this changes
Friday puts a demand reading on top of a scare already two sessions old, with the July quarter still the last reported one. The 5.26% rise on 21 October lines up with the PHP disclosure, and Friday lines up with the channel survey as TIKR and Yahoo describe it. The close above $247.25 sits on the far side of the average target, while the survey's response counts remain inside Evercore's note. Between that close and the 1 December earnings date, the open variables are net new ARR and whether exploitation stays at the probing stage Duque and Conrad described.
What would change the reading
A primary Evercore note that leaves CrowdStrike off the list of budget beneficiaries would remove the demand half of the catalyst. A filing that changes the 34% net new ARR growth midpoint from August would break the link between firmer budgets and the guidance still on the record. Widespread successful exploitation would date the Friday research post, and a clean patch cycle would make the scare look like a one-week event.
On the tape, a later settle through the 16 October close of $227.39 would recast Friday as one heavy session inside the drawdown from $286.99. A later settle above the 6 October close of $278.86 would recast it as a push through that high. Those two closes already bracket Friday's print.
Key facts
- CrowdStrike closed at $257.57 on 23 October 2026, up $19.63, or 8.25%, from $237.94, on volume of 13,400,055 shares, inside a range of $234.79 to $257.91. Source: StockAnalysis quote and history bar, 4:00 p.m. Eastern, retrieved 26 October 2026.
- The 6 October close was $278.86 and that day's high was $286.99, the 52-week high. Friday finished 7.63% under that close and 10.25% under that high. Source: StockAnalysis history and quote, retrieved 26 October 2026.
- The overview showed a $247.25 average target from 53 analysts, marked 4.01% under the latest price, a forward price-to-earnings ratio of 182.32 and a market capitalisation of $264.30 billion. Source: StockAnalysis overview, retrieved 26 October 2026.
- Annual recurring revenue was $5.84 billion at 31 July 2026, up 25%, with second-quarter revenue of $1.47 billion, up 26%. Source: CrowdStrike exhibit 99.1, filed 26 August 2026.
- PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026, describing both as unauthenticated remote code execution, rated CVSS v4.0 9.2. Source: php.net news archive, opened 26 October 2026.
- CrowdStrike's 23 October research post limited observed activity to testing, probing and unsuccessful attempts, while a briefing page cited about 275,000 IP addresses on vulnerable PHP. Sources: CrowdStrike blog and crowdcast page, opened 26 October 2026.
Questions the session leaves open
Did Friday set a high?
Friday's close of $257.57 finished $29.42 under the 52-week high of $286.99, printed on 6 October, which also holds the series high close of $278.86. The rebound from the 16 October close of $227.39 measured 13.27% and stopped short of both marks. The after-hours print of $258.40 left that order unchanged. StockAnalysis quote and history pages, 26 October 2026, are the source.
What is actually known about the Evercore survey?
Evercore's client note stayed off the pages we could open. TIKR, on 23 October, described firmer year-end budgets, healthy pipelines and spending on data, AI, identity and cloud, with Okta strongest on pipeline momentum. Yahoo's GuruFocus item the same day said the survey named CrowdStrike and Palo Alto as leading beneficiaries and had the shares up 5.87% at 1:20 p.m. Eastern. Response counts stayed inside the client note, and the official close was 8.25%.
What do the PHP flaws allow, on the vendor's page?
PHP's 21 October advisory says CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution, with the highest risk on Apache mod_php. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the pre-release notice rated both CVSS v4.0 9.2. On 23 October PHP added CVE-2026-115560 and asked admins to keep session upload progress disabled until the next bugfix, calling the required setup unlikely.
How does the close compare with the last reported quarter?
The quarter we opened is fiscal second-quarter 2027, ended 31 July 2026. Revenue was $1.47 billion, up 26%, and ARR was $5.84 billion, up 25%. GAAP net income was $5.3 million and non-GAAP net income was $322.9 million. Friday's displayed market capitalisation of $264.30 billion is 45.3 times that July ARR on our arithmetic, and the overview's next earnings date is 1 December 2026.
Which prior closes would reframe Friday?
A later settle through the 16 October close of $227.39 would make Friday look like one heavy day inside the drawdown from the early-October high. A later settle above the 6 October close of $278.86 would make it look like a push through that high. The August guidance still on file is 34% net new ARR growth at the midpoint. A filing that changes the midpoint would reframe the budget story.
This is a record of the 23 October session and the documents behind it. It is not a recommendation to buy, sell or hold any security.