Cybersecurity stocks are the companies that sell protection for networks, logins and data. This week they got a free advertisement. A bug in PHP, the language behind about 70% of websites, sent governments and companies offline as a precaution, and security stocks rallied for two days. We ranked all 26 names in our AI Cyber Defense theme against their own five-year valuation history to show who moved, who is exposed, and which ones the market had not already paid for.
Quick Answer
1. The rally rotated. Tuesday belonged to the names that guard web traffic and logins: Zscaler +7.8%, Okta +7.5%, Datadog +6.5%. Wednesday belonged to the companies that find unpatched software: Rapid7 +9.0%, Qualys +5.8%, Check Point +6.0%, while Datadog gave back 5.6% and Okta 3.5%. 2. The big platforms were priced for this before it happened. CrowdStrike sits at the 97th percentile of its own five-year EV/Sales range, Fortinet at the 95th, Palo Alto Networks at the 93rd. Historically high, by each company's own standard. 3. The favorite is on the vulnerable list. Palo Alto confirmed that every version of its PAN-OS firewall software and Panorama is affected, and had no fixed release out as of Thursday morning. Fortinet is checking 12 products. 4. Still below their own range, still growing: Zscaler (17th percentile after a 10.8% two-day jump, revenue up 25%) and Elastic (29th, up 16%). SentinelOne sits at the 33rd with 21% growth. 5. Cheap for a reason: Rapid7 (9th percentile, flat revenue) and Booz Allen Hamilton (10th, revenue down 7%). 6. The ETF did less than the headlines. CIBR, the cybersecurity ETF our theme uses as its benchmark, rose 2.4% over the two days. 7. Nobody has confirmed a breach. The outages were precautionary, CISA had not observed exploitation when it issued its alert, and the revenue effect on these companies is unknown.
What actually happened, in plain words
Two bugs in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an attacker run their own code on a web server with a single request, before the website's own software gets a say. Wiz's write-up says nearly every PHP version since 5.4, released in 2012, is affected, and that PHP powers roughly 70% of websites, including WordPress, Drupal and Joomla sites.
Humans found it with AI doing the heavy lifting. Calif, a security firm, found the first path in August while working with OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet program. Wiz found it independently using Gemini 4 Argon, GPT-5.6 Sol and its own tooling. The PHP Foundation shipped fixes on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, a day early, after the CVE numbers leaked with a wrong severity score of 10.0. The real score is 9.2.
CISA told organizations to patch immediately and to take PHP systems offline if they could not. Many did. The Guardian reported websites shutting down around the world, and Reuters carried the EU cyber agency's warning that sites might need to go dark until patched. Amazon's threat intelligence team saw exploitation attempts against its honeypots from October 17, before the public disclosure, and says it is unclear whether any of them would have succeeded on real systems. CISA had not observed exploitation when it published its alert.That is the whole event so far: a very bad bug, a fast patch, a precautionary blackout, and no confirmed victim. Keep that in mind while reading the stock moves.
The takeaway: This was a patching emergency, not a breach wave. The stocks moved on the headline, not on anyone's revenue.
The two-day scoreboard
Every name in our AI Cyber Defense theme, sorted by the two-day move. The valuation columns come from our October 22 refresh, which prices each stock at its October 21 close, so Wednesday's moves are not in the percentiles yet. The percentile ranks today's EV/Sales against the company's own weekly readings over the last five years; "Where it sits" is our fixed vocabulary for that rank. Our guide explains what a valuation percentile is and how we compute it.
| Ticker | Layer | Tue Oct 21 | Wed Oct 22 | EV/Sales now | 5y %ile now | Where it sits |
|---|---|---|---|---|---|---|
| NTSK | Zero trust and edge | +10.0% | +1.8% | 10.6x | too new | Not ranked (listed Sept 2025) |
| RPD | Security operations | +2.2% | +9.0% | 0.6x | 9 | Historically low |
| ZS | Zero trust and edge | +7.8% | +2.8% | 11.3x | 17 | Below its usual range |
| QLYS | Security operations | +3.3% | +5.8% | 9.4x | 61 | Within its usual range |
| CHKP | Platforms | +1.8% | +6.0% | 5.2x | snapshot | Not ranked (annual filer) |
| TENB | Security operations | +4.3% | +3.3% | 4.2x | under review | Under review |
| CVLT | Data and recovery | +4.9% | +2.6% | 5.6x | 70 | Above its usual range |
| PSN | Government cyber | +1.7% | +5.3% | 1.0x | under review | Under review |
| SAIC | Government cyber | +1.2% | +5.0% | 1.1x | 75 | Above its usual range |
| LDOS | Government cyber | +1.2% | +4.3% | 1.2x | 20 | Below its usual range |
| RBRK† | Data and recovery | +5.1% | +0.3% | 15.7x | 80 | Above its usual range |
| BAH | Government cyber | +0.1% | +4.7% | 1.1x | 10 | Historically low |
| CRWD | Platforms | +5.3% | -0.6% | 45.5x | 97 | Historically high |
| PANW | Platforms | +2.0% | +2.2% | 23.0x | 93 | Historically high |
| SAIL† | Identity | +2.3% | +1.9% | 9.3x | 79 | Above its usual range |
| NET | Zero trust and edge | +5.3% | -1.2% | 42.5x | 88 | Above its usual range |
| OKTA | Identity | +7.5% | -3.5% | 11.4x | 89 | Above its usual range |
| ESTC | Security operations | +3.3% | -0.6% | 5.2x | 29 | Below its usual range |
| S | Security operations | +3.5% | -1.2% | 6.5x | 33 | Within its usual range |
| CACI | Government cyber | +2.6% | -0.7% | 1.9x | 97 | Historically high |
| AKAM | Zero trust and edge | +0.7% | +1.0% | 3.8x | 21 | Below its usual range |
| FTNT | Platforms | +1.8% | -0.6% | 16.8x | 95 | Historically high |
| DDOG | Security operations | +6.5% | -5.6% | 24.5x | 82 | Above its usual range |
| VRNS | Data and recovery | +0.0% | +0.4% | 7.8x | 49 | Within its usual range |
| FFIV | Zero trust and edge | +0.4% | -1.9% | 7.5x | 99 | Historically high |
| MSFT | The bundler | +0.2% | -2.2% | 11.9x | 52 | Within its usual range |
Where these stand now
Current readings update separately from the article’s dated analysis.
As of
ZS's EV/Sales of 11.6x is lower than 83% of its weekly readings over the last five years.
As of
PANW's EV/Sales of 23.5x is higher than 93% of its weekly readings since May 2022.
CRWD valuation coverage: the EV/Sales reading or historical rank is unavailable or under review.
Who won
Day one rewarded the companies that stand between the internet and a web server. Zscaler, which inspects traffic between users and applications, rose 7.8%. Okta, which decides who may log in, rose 7.5%. Cloudflare, which sits in front of millions of websites, rose 5.3%. CrowdStrike rose 5.3% and Rubrik, which sells recovery for when something gets through, rose 5.1%. Netskope, the newest listing in the group, jumped 10.0%.
Day two told a different story. A bug in every version of a language since 2012 is first a scanning and patching problem: which of your thousands of servers runs PHP, which version, and did the fix land? That is what Tenable, Qualys and Rapid7 sell. Rapid7 rose 9.0% on Wednesday, Qualys 5.8%, Tenable 3.3%. Check Point, the slow-growing firewall vendor, rose 6.0%. The government IT contractors, whose agency customers now have patch work to do, caught up: Parsons +5.3%, SAIC +5.0%, Booz Allen +4.7%, Leidos +4.3%. Meanwhile Tuesday's leaders cooled. Datadog gave back 5.6%, Okta 3.5%, Cloudflare 1.2%.
Morgan Stanley's Meta Marshall told clients on Thursday that "while 2027 setups [are] tricky, [we] see tactical longs in the group," CNBC reported. Tactical is the operative word. The cybersecurity ETF CIBR rose 2.7% on Tuesday and slipped 0.3% on Wednesday, a 2.4% two-day move. Most of the excitement was in individual names, and the equal-weight basket on our theme page shows whether the typical member did better than the cap-weighted fund.
The takeaway: Tuesday bought the gatekeepers (Zscaler, Okta, Cloudflare). Wednesday bought the patch crews (Rapid7, Qualys, Tenable) and the government contractors. The ETF moved 2.4% over the two days.
Who is exposed
Here is the part the rally skipped over. Security products run on software too, and a lot of that software is PHP.
Palo Alto Networks, the name most often called the winner of this cycle, confirmed on Thursday that all versions of PAN-OS and Panorama, the software inside its firewalls and the console that manages them, are affected by PHP2Shell. As of 6:25 AM Eastern it had not shipped fixed releases, according to Help Net Security's running update. Fortinet is checking 12 of its products and Cisco 31 products and cloud services; neither had confirmed a vulnerable one at that point.
The market did not care. Palo Alto rose 2.0% on Tuesday and 2.2% on Wednesday. That is a reasonable reaction if you believe a management console bug gets patched quietly and the real effect is customers calling to ask what else they should buy. It is a strange reaction if you bought Palo Alto this week as the clean beneficiary of a bug it has to patch itself.
Microsoft, the one member of our theme that bundles security into bigger contracts rather than selling it alone, fell 2.2% on Wednesday and 2.0% over the two days. Its software does not run on PHP. It also does not get a headline bump when the internet catches fire.
The takeaway: Being exposed and being a beneficiary are not opposites. Palo Alto is both this week. If you are buying it for the bug, know that it is on the patch list.
The ones priced like they already won
We wrote in early October that the AI cyber trade was already priced, with the platforms at the 96th to 98th percentile of their own ranges. Two weeks and one internet emergency later, the picture is the same with slightly different numbers.
CrowdStrike trades at 45.5 times trailing sales, the 97th percentile of its five-year range and about 1.9 times its own median of 24.0. Fortinet trades at 16.8 times sales, the 95th percentile, against a median of 11.1. Palo Alto trades at 23.0 times, the 93rd percentile, against a median of 13.6; part of that is the CyberArk acquisition inflating the trailing multiple, which we unpacked in Palo Alto vs CrowdStrike at the 98th percentile. F5, which sells the gear that sits in front of the applications attackers target, is at the 99th percentile on about 9% revenue growth, and it fell 1.5% over the two days. CACI, the government cyber contractor, is at the 97th.
"Historically high" in our vocabulary means the multiple was lower in at least 90% of weekly readings over the past five years. It is a description of history. It does not say the stock will fall. It does say the market paid for the AI security spending story long before PHP2Shell, which is the point David Friedberg's budget prediction ran into when we checked it: the stocks had already done what he predicted the budgets would do.
The takeaway: CrowdStrike, Fortinet, Palo Alto, F5 and CACI all sit in the top tenth of their own five-year valuation ranges. This week's news arrived at the top of the range, not the bottom.
The ones the market had not paid for
If the question is "which cybersecurity stocks are cheap," our answer is narrower than you might like, and it comes with a definition. Cheap here means low relative to the company's own five-year history. It does not mean cheap against the market, and it does not mean the price will recover.
- Zscaler (ZS): 11.3 times sales, the 17th percentile, median 14.5, revenue up 25%. It jumped 10.8% over the two days and is still below its usual range. The reason is a one-day 31% drop after its May guidance, which we covered in why Zscaler sat at the 14th percentile while cyber rallied. Watch Zscaler's EV/Sales history to see how much of that gap closed this week.
- Elastic (ESTC): 5.2 times sales, the 29th percentile, median 6.1, revenue up 16%. Elastic stores the logs defenders search after an incident. It rose 2.7% over the two days, less than the group.
- SentinelOne (S): 6.5 times sales, the 33rd percentile, median 8.2, revenue up 21%. Within its usual range, in the lower part of it.
- Tenable (TENB): 4.2 times sales and up 7.7% over the two days. Our percentile for Tenable is under review this week, so we are not quoting one.
- Akamai (AKAM): 3.8 times sales, the 21st percentile, but revenue is growing about 6%. Low rank, slow business.
- Leidos (LDOS): 1.2 times sales, the 20th percentile, revenue up about 4%.
Our cybersecurity valuation screen keeps this ranking current and lets you sort it yourself. If the band charts are new to you, start with how to read a valuation band chart.
The takeaway: Zscaler and Elastic are the two names below their own usual range with double-digit revenue growth. SentinelOne is close. Rapid7 and Booz Allen are low because their businesses have stalled or shrunk.
Does the bug change anyone's revenue?
Honest answer: nobody knows yet, and the people paid to know say so. Marshall's "tactical" framing and her warning about tricky 2027 setups both appear in the same CNBC note. A patch cycle creates work for security teams and some emergency spending on scanning and web firewalls. It does not create a new budget line, and the typical security budget was not growing before this: an IANS and Artico survey of more than 500 security leaders found median 2026 budget growth of 0%.
What the bug does change is the argument for the whole theme. The thesis behind our AI Cyber Defense page is that AI will make attacks faster and defense a race. PHP2Shell is the first time the public saw that argument from the defender's side: AI models, steered by people, found a 14-year-old bug in code that had been read by thousands of engineers. Anthropic reported in February that its models had found and validated more than 500 high-severity vulnerabilities in open-source software, some undetected for decades. Expect more weeks like this one. Whether that is good or bad for a given security stock depends on whether it sells the shovel (scanning, patching, web firewalls) or is the thing being patched.
The takeaway: The direct revenue effect is unknown and probably small. The indirect effect is that the "AI finds bugs faster than people" story is now something every board has seen, which is the thesis the platforms were already priced for.
If you are deciding this week
We do not tell anyone what to buy. We can tell you the three checks our data supports, in the order that saves the most trouble.
1. Where does it sit in its own range? Buying a company at the 97th percentile of its own history means paying for good news already known. Buying at the 17th means the market has a worry you should find before you dismiss it. 2. Is revenue still growing? The percentile only means something next to the growth rate. Zscaler at the 17th with 25% growth and Rapid7 at the 9th with 0% growth are different situations, and the table above shows which is which. 3. Is it on the vulnerable list? For this specific event, check whether the company you are buying as a winner is also patching its own products. Palo Alto is. Fortinet may be.
If you would rather own the theme than pick within it, CIBR holds the large names weighted by size, which is why it moved 2.4% while individual stocks moved 5% to 12%. Our theme page shows an equal-weight basket of all 26 against CIBR so you can see what the typical member did.
FAQ
How do I invest in cybersecurity stocks? Two routes. An ETF such as CIBR or HACK holds a basket of security companies weighted by size, so you own the theme without picking names. Individual stocks let you choose the layer you believe in (platforms, identity, zero trust, security operations, recovery, government contractors), and our cybersecurity valuation screen shows where each one sits against its own history. Either way, know the growth rate and the valuation percentile before the ticker. Is it too late to buy cybersecurity stocks after the PHP bug? We do not give that advice. What our data shows: the largest platforms (CrowdStrike, Fortinet, Palo Alto) are in the top tenth of their own five-year valuation ranges, which means the market paid for the AI security story before this week. A few names, led by Zscaler and Elastic, are still below their usual range while growing revenue at double-digit rates. The table above gives you all 26. Which cybersecurity stocks are cheap right now? Relative to their own five-year history, as of October 22, 2026: Rapid7 (9th percentile), Booz Allen (10th), Zscaler (17th), Leidos (20th), Akamai (21st) and Elastic (29th). Only Zscaler and Elastic pair that with double-digit revenue growth. Rapid7 and Booz Allen are low because revenue stalled or shrank. Which cybersecurity companies are affected by PHP2Shell? Palo Alto Networks confirmed all versions of PAN-OS and Panorama are affected and had no fixed release as of Thursday morning. Fortinet was checking 12 products and Cisco 31; neither had confirmed a vulnerable one. The source is Help Net Security's running update. Any vendor whose management console runs PHP is a candidate. Does the PHP vulnerability mean more revenue for cybersecurity companies? Unknown. It creates emergency patching work and some spending on scanning and web firewalls, which helps names like Tenable, Qualys, Rapid7 and Cloudflare in the short run. It does not create a new budget, and median security budget growth for 2026 was 0% before this happened. Analysts called the trade tactical, not structural. What is PHP2Shell in plain words? Two bugs in PHP, the language that runs about 70% of websites, that let an attacker run their own code on a server with one request. They existed in every version since 2012. Security researchers found them in August with help from AI models, PHP shipped fixes on October 21, and governments told organizations to patch immediately or take sites offline until they could. No breach had been confirmed as of October 22. Should I just buy a cybersecurity ETF? It depends on whether you want the theme or a view within it. CIBR rose 2.4% over the two days while individual members moved from -2.0% (Microsoft) to +12.0% (Netskope). The ETF smooths that out and tilts toward the largest, most expensive names. Our theme page compares an equal-weight basket of the 26 against CIBR so you can see the difference.Every number above refreshes on the AI Cyber Defense theme page, which groups the basket by layer and tracks it against CIBR. The cybersecurity valuation screen ranks the vendors by EV/Sales percentile, and each company has its own band chart, starting with Zscaler, Palo Alto Networks and CrowdStrike.
Data: SEC EDGAR XBRL filings and market prices, computed by StockResearch as of October 22, 2026; the refresh prices each stock at its October 21 close. Daily moves are closing prices from Yahoo Finance for October 20 to 22. Revenue growth is trailing twelve months from our dataset. Alex works on StockResearch research and the monthly valuation report. Nothing here is investment advice or a recommendation to buy or sell any security. Do your own research.