To The Moon

One of the strongest themes in U.S. software stocks this week came from cybersecurity.

Following a U.S. government warning about critical PHP vulnerabilities, Palo Alto Networks climbed roughly 7%, Zscaler gained 7.8%, and CrowdStrike rose 5.2%. The Amplify Cybersecurity ETF advanced 3.2%, while First Trust’s cybersecurity ETF gained 2.7%. (CNBC)

The immediate catalyst: two vulnerabilities dubbed “php2shell,” tracked as CVE-2026-109618 and CVE-2026-109619.

PHP powers a large number of websites and web applications, including much of the WordPress and Drupal ecosystems. According to the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, the flaws could allow unauthenticated attackers to execute code remotely and affect all PHP installations serving web requests.

CISA urged organizations to patch immediately—or take affected systems offline if they could not do so promptly. Web application firewalls could offer some temporary protection, but organizations would still need to identify affected assets, apply fixes, monitor activity, and investigate potential compromise. (CISA advisory)

Governments and businesses in several countries temporarily took some websites offline while deploying patches and conducting security checks. (Reuters)

But one detail makes this rally particularly interesting: at the time of its warning, CISA said it had not observed exploitation of the vulnerabilities.

The rally was not a reaction to confirmed widespread attacks and mounting losses. Investors appeared to be pricing in a different idea:

When a flaw in foundational software can force a company to shut down its website, cybersecurity becomes much harder to treat as discretionary IT spending.

An enterprise may delay an AI pilot or defer some server purchases. A “patch now or go offline” warning demands a much faster response.

That does not guarantee new software purchases. It does, however, highlight why security budgets can be difficult to cut.

AI Creates More Than an Opportunity for Hackers

Many software companies are still proving that AI can generate meaningful new revenue. Security vendors address a more immediate issue: every additional model, agent, and cloud application introduces more accounts, data, code, and permissions to protect.

Historically, much of cybersecurity focused on people accessing systems.

In the agent era, enterprises must also secure AI accessing systems on people’s behalf.

An agent might connect to a code repository, email, a customer database, and payment tools. If permissions or runtime protections are weak, compromising one privileged agent could expose multiple business systems.

The opportunity for security vendors therefore extends well beyond hackers using AI. It also comes from the new attack surface created by companies deploying AI themselves:

• Which models can employees use?

• What data can those models read?

• What actions can an agent take?

• Who grants permissions to non-human identities?

• Is every action logged and auditable?

These questions point directly to Zero Trust, identity security, data loss prevention, cloud security, and runtime monitoring.

One Vulnerability Can Touch Multiple Security Budgets

The PHP incident also illustrates why demand need not concentrate in a single vendor’s product.

Organizations first need to locate affected servers and applications—a task associated with vulnerability and asset management platforms such as Qualys and Tenable.

They then need to patch those systems and reinforce network and web defenses, areas where products from Palo Alto Networks, Fortinet, and Cloudflare may play a role.

If a compromise is suspected, endpoint detection platforms such as CrowdStrike can help investigate unusual processes and activity. Zscaler addresses another layer: Zero Trust access between users, cloud applications, and enterprise data.

A single incident can create work across several layers of the security stack.

The investment question is how much of that work becomes incremental, recurring revenue rather than being absorbed by existing contracts, tools, and internal teams.

A Stock Rally Is Not an Order Book

A 5%–8% move in a day does not mean vendors have suddenly secured a comparable increase in orders.

CISA’s initial advisory did not report observed exploitation. Part of the rally may therefore reflect investors positioning ahead of the broader AI security theme.

CRWD, PANW, and ZS already carry demanding valuations. Without evidence of stronger net new ARR, major customer wins, or higher earnings guidance, an event-driven rally can reverse quickly.

Tiger’s Take

I think the bigger story is cybersecurity’s place in the AI investment cycle.

The first phase of the AI trade centered on GPUs, data centers, power, and networking. As AI moves into everyday enterprise operations, security could become a prerequisite for deployment.

Without identity controls, data isolation, permission management, and runtime monitoring, many organizations will hesitate to let agents interact with core business systems.

The next question is whether vendors can turn that need into measurable growth. An “AI” product announcement alone will not answer it.

I would watch three things:

1. Can AI security generate separately identifiable revenue and ARR?

2. Are enterprises expanding total security budgets, or simply reallocating existing spending?

3. Are identity, data, and agent runtime protections becoming standard requirements for enterprise AI deployment?

If those trends consistently show up in earnings reports, cybersecurity could evolve from an occasional incident-driven trade into a durable beneficiary of broader AI spending.

Stocks to Watch

Security platforms: $Palo Alto Networks(PANW)$Palo Alto Networks(PANW)$
Watch whether enterprises continue consolidating firewall, cloud security, and security operations spending onto a unified platform.

Endpoint and runtime protection: $CrowdStrike(CRWD)$CrowdStrike Holdings, Inc.(CRWD)$
Watch whether AI-enabled threats and agent adoption support sustained demand for endpoint detection, threat intelligence, and automated response.

Zero Trust and data security: $Zscaler(ZS)$Zscaler Inc.(ZS)$
Watch whether access controls become a standard part of connecting models and agents to enterprise data.

Network and web protection: $Fortinet(FTNT)$Fortinet(FTNT)$ and $Cloudflare(NET)$Cloudflare, Inc.(NET)$
Watch demand for firewalls, web application protection, and edge security as organizations’ internet-facing attack surfaces expand.

Vulnerability management: $Qualys(QLYS)$Qualys(QLYS)$ and $Tenable(TENB)$Tenable Holdings Inc.(TENB)$
Watch whether asset discovery and vulnerability assessment become ongoing priorities rather than emergency projects.

Today’s Poll

What do you think investors are pricing in with this cybersecurity rally?

① A durable wave of new security spending in the agent era
② An immediate boost to vulnerability management—companies must find exposed assets first
③ More platform consolidation, with budgets flowing to the largest vendors
④ An event-driven trade, with share prices moving faster than orders

For market discussion and informational purposes only. These are personal views, not investment advice. Investing involves risk; make your own informed decisions.