Website PHP Flaws Spur a Cybersecurity Stock Rally-but Not All Are Buys -- Barrons.com

By Jack Denton

Companies and governments around the world scrambled this week to take down or update websites amid revelations that a widely used programming language had critical vulnerabilities that could be exploited in AI-assisted attacks.

As might be expected, a number of cybersecurity stocks have rallied in turn. But investors looking to play the broader trend should beware: cybersecurity stocks are far from equal.

Cybersecurity researchers including Wiz Research identified "multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world," the firm said on Wednesday. The same day, PHP developers released a patch fixing those vulnerabilities, and website operators are scrambling to implement it it to prevent attacks.

In the UK, 32 online government services are unavailable, and the National Cyber Security Centre said the scale of the flaw was "unprecedented," with other governments globally also responding. The operator of Wikipedia and the Internet Archive digital library are among non-state groups that have also been affected.

The CEO of web infrastructure and security company Cloudflare, Matthew Prince, posted on social media that the group saw thousands of attempts to exploit the PHP flaw across its network in the hours before it was announced. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," Prince said.

Revelations that a widely used tool could have such flaws -- which Wiz Research said "could allow attackers to take control of affected servers, steal sensitive data, and deface the websites" -- further raise the specter of AI-assisted attacks that exploit vulnerabilities before they're fixed.

"The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," Wiz Research said.

Cybersecurity stocks have seen a bump since late Tuesday, before the PHP vulnerabilities were made public. Cloudflare stock is up 5% over that period, with CrowdStrike stock rising 3%. Palo Alto Networks stock gained 4% and Zscaler stock jumped 9%, with Tenable stock rising 3% and Fastly stock up 3%.

Many of those stocks were paring their gains in early Thursday trading.

But the broader focus on AI security could support demand for these companies, which all represent different parts of the cybersecurity ecosystem, from enterprise mega-platforms like Palo Alto Networks to edge computing specialists like Fastly.

As Barron's has reported, the safety and security debate around AI has reignited a focus on cybersecurity, with many stocks notching impressive gains this year. Fastly stock is up 125% in 2026, with CrowdStrike and Palo Alto Networks seeing their stocks double in the same period.

Cybersecurity stocks, which often trade at stretched valuations, can be fickle and cyclical -- and much of the sector has already seen a big rally this year. Wall Street sees some names as better positioned than others.

Cloudflare gets a Buy rating from 73% of analysts surveyed by FactSet, with an average target price of $311 suggesting 13% upside is still ahead. Palo Alto Networks is another favorite, also with Buy ratings from 73% of analysts and 13% implied upside from the average price target.

Some favorites may have seen most of their rally already, like CrowdStrike stock, with Buy ratings from 74% of analysts but only 5% implied upside at its current price, and Zscaler stock, rated Buy by 74% of analysts yet with just 1% upside.

Fastly, for its part, has analysts split roughly down the middle between Buy and Hold ratings, yet their average price target suggests 24% in gains. Tenable, however, is rated Hold by the majority of analysts, with the average price target suggesting 10% downside.

Write to Jack Denton at jack.denton@barrons.com

This content was created by Barron's, which is operated by Dow Jones & Co. Barron's is published independently from Dow Jones Newswires and The Wall Street Journal.

(END) Dow Jones Newswires

October 22, 2026 12:02 ET (16:02 GMT)