--- title: "Rapid7 counted AI in 8% of incidents as CrowdStrike rose 6% on Nvidia's agent-security list" description: "Security stocks re-rated on Nvidia's agent-security partner list in the same 48 hours Rapid7's Q3 telemetry put AI inside 8 percent of tracked incidents, with humans still choosing every target. The threat actually on the wire showed up in PHP: two unauthenticated code-execution flaws probed four days before they were disclosed." publisher: "The Inference" section: "Security" published: 2026-10-22T15:27:01.322Z modified: 2026-10-22T15:27:01.322Z canonical: https://theinference.org/article/rapid7-counted-ai-in-8-of-incidents-as-crowdstrike-rose-6-on-nvidia-s-agent-security-list language: en keywords: "Cybersecurity, Threat Intelligence, Ransomware, Nvidia, Stock Moves" --- # Rapid7 counted AI in 8% of incidents as CrowdStrike rose 6% on Nvidia's agent-security list > Security stocks re-rated on Nvidia's agent-security partner list in the same 48 hours Rapid7's Q3 telemetry put AI inside 8 percent of tracked incidents, with humans still choosing every target. The threat actually on the wire showed up in PHP: two unauthenticated code-execution flaws probed four days before they were disclosed. ## The partner list moved the money, the telemetry did not On October 21, [CrowdStrike](https://theinference.org/markets/companies/crowdstrike) [rose 6 percent to $241.02](https://theinference.org/article/crowdstrike-rose-6-to-241-02-as-security-stocks-jumped-8-on-an-nvidia-agent-deal-with-no-terms) after [Nvidia](https://theinference.org/markets/companies/nvidia) named 11 security partners for its OpenShell agent architecture at GTC Berlin, a list with no dollar terms attached, and the security complex rose as much as 8.3 percent in the session [10]. [Datadog](https://theinference.org/markets/companies/datadog) gained 6 percent and [Okta](https://theinference.org/markets/companies/okta) 4 percent, gains one trading desk called expectation-driven until adoption data arrives [9]. *Chart: **The agent-security list re-rated the security complex in one session** Bar chart of one-day share-price gains on October 21, 2026: CrowdStrike 6 percent, Datadog 6 percent, Okta 4 percent* *One-day share-price gains on October 21, 2026, the session after Nvidia named 11 security partners for its OpenShell agent architecture at GTC Berlin. Source: 24/7 Wall St. [9]* The same 48 hours delivered [Rapid7](https://theinference.org/markets/companies/rapid7)'s [Q3 2026 Quarterly Threat Landscape Report](https://www.stocktitan.net/news/RPD/rapid7-report-human-operators-still-drive-most-of-tracked-3s7fum4zrzkq.html), drawn from the company's own incident-response telemetry: AI was an operational component in 8 percent of tracked incidents, and a human still chose the target in every documented case [1][5]. "The board-deck version of this year has been wall-to-wall AI attackers, and the data doesn't support that story," said Douglas McKee, Rapid7's director of vulnerability intelligence [5]. ## What attackers actually did in Q3 High-severity vulnerabilities were exploited an average of three days after disclosure, 71 percent inside the first week, and 79 percent needed no authentication and no user interaction, the class Rapid7 calls "holy grail": a door that opens without a login or a click [1][5]. Ransomware stayed human-run at scale, with [1,112 US leak-site listings](https://www.securityweek.com/high-severity-flaws-exploited-in-three-days-as-ransomware-dominates-q3-rapid7/), roughly eight times Germany's, and two brands in a dead heat [1][5]. High-severity disclosures rose 133 percent year over year, and one in ten public proofs of concept became a working attack within 30 days [2]. *Chart: **Two ransomware brands claimed more incidents than the next three combined** Bar chart of claimed ransomware incidents by group in Q3 2026: The Gentlemen 342, Qilin 339, INC Ransom 99, DeadLock 98, KryBit 95* *Claimed ransomware incidents on leak sites, Q3 2026, as tracked in Rapid7's Quarterly Threat Landscape Report. [5]* ## PHP showed the real shift: speed, not autonomy The live counterexample landed the same day. PHP [shipped emergency fixes on October 21](https://www.php.net/archive/2026.php) for [CVE-2026-109618 and CVE-2026-109619](https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/), two CVSS 9.2 unauthenticated remote-code-execution flaws in the runtime behind almost 70 percent of websites, and an update is the only complete remediation [3][7][8]. [Amazon](https://theinference.org/markets/companies/amazon)'s MadPot honeypot [logged the first exploitation attempt on October 17](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html), four days before disclosure and while the flaws were under embargo [6][7]. [Cloudflare counted thousands of attempts in the 10 hours before the release](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/) and millions since, and about one million of 2.6 million internet-facing PHP hosts run versions that no longer get fixes [6][7]. Amazon CISO CJ Moses named the mechanism: AI-assisted analysis makes it cheaper to turn a patch diff into a working exploit, letting more actors move "within hours or even minutes" [7]. Rapid7's own vice president of intelligence, Christiaan Beek, calls the 8 percent "a snapshot of adoption, not a ceiling" [1]. ## The vendor at the bottom of its range The company that measured all this closed at $13.22 on October 19, in a 52-week range of $4.97 to $19.84, with insiders net buyers of $3.8 million and [a 56-of-100 GuruFocus quality score](https://www.gurufocus.com/news/9130730/rapid7-inc-rpd-stock-up-48-and-still-undervalued-gf-score-56100) flagged as a possible value trap [4]. Revenue growth has slid from 13.1 percent to negative across twelve quarters [11]. The Intelligence unit that shipped same-day detection for [GitLab's 10.0 flaw](https://theinference.org/article/rapid7-turns-gitlab-s-10-0-flaw-into-a-live-product-demo-three-weeks-before-earnings) on October 13 [10] faces its own test on November 4, when Rapid7 reports third-quarter results [1]. *Chart: **Rapid7's growth slid for twelve straight quarters, into decline** Line chart of Rapid7's year-over-year revenue growth by quarter, sliding from 13.1 percent in Q3 2023 to minus 1.5 percent in Q2 2026* *Year-over-year revenue growth by quarter, percentages, from Rapid7's SEC filings, retrieved 22 October 2026. The line crosses zero between Q1 and Q2 2026. [11]* This week's premium accrued to the names attached to the agent story. The attacker already here works in three days and needs no password. ## Takeaway Security stocks re-rated on Nvidia's agent-security partner list in the same 48 hours Rapid7's Q3 telemetry put AI inside 8 percent of tracked incidents, with a human still choosing every target. The threat actually on the wire was two PHP code-execution flaws probed four days before disclosure, with a three-day average exploit window and roughly a million internet-facing PHP hosts on versions that no longer get fixes. ## Sources 1. [StockTitan, Rapid7 Q3 2026 Quarterly Threat Landscape Report press release, 21 October 2026](https://www.stocktitan.net/news/RPD/rapid7-report-human-operators-still-drive-most-of-tracked-3s7fum4zrzkq.html) 2. [SMBtech, Rapid7 Report Finds Critical PHP Flaws Could Expose Millions of Web Servers to Remote Takeover, 22 October 2026](https://smbtech.au/news/rapid7-report-finds-critical-php-flaws-could-expose-millions-of-web-servers-to-remote-takeover/) 3. [Rapid7 blog, CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP, 21 October 2026](https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/) 4. [GuruFocus, Rapid7 Inc (RPD) Stock Up 4.8% and Still Undervalued, GF Score 56/100, 19 October 2026](https://www.gurufocus.com/news/9130730/rapid7-inc-rpd-stock-up-48-and-still-undervalued-gf-score-56100) 5. [SecurityWeek, High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7, 21 October 2026](https://www.securityweek.com/high-severity-flaws-exploited-in-three-days-as-ransomware-dominates-q3-rapid7/) 6. [SecurityWeek, PHP2Shell Exploitation Started Days Before Patches, 22 October 2026](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/) 7. [The Hacker News, Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed, 22 October 2026](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html) 8. [PHP.net, News Archive 2026: Security advisory on critical remote code execution vulnerabilities, 21 October 2026](https://www.php.net/archive/2026.php) 9. [24/7 Wall St, CrowdStrike Rallies 4% on Expanded NVIDIA AI Security Pact; Datadog Jumps 6%, Okta Climbs 4%, 21 October 2026](https://247wallst.com/investing/2026/10/21/crowdstrike-rallies-4-on-expanded-nvidia-ai-security-pact-datadog-jumps-6-okta-climbs-4/) 10. [The Inference, Rapid7 turns GitLab's 10.0 flaw into a live product demo, three weeks before earnings, 16 October 2026](https://theinference.org/article/rapid7-turns-gitlab-s-10-0-flaw-into-a-live-product-demo-three-weeks-before-earnings) 11. [Rapid7 quarterly figures from its SEC filings, retrieved 22 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001560327) --- Rapid7 counted AI in 8% of incidents as CrowdStrike rose 6% on Nvidia's agent-security list — The Inference. Canonical: https://theinference.org/article/rapid7-counted-ai-in-8-of-incidents-as-crowdstrike-rose-6-on-nvidia-s-agent-security-list