Cybersecurity Stocks Rally as NSA and FBI Warn of Critical PHP Flaws

Cybersecurity stocks rallied Wednesday as the NSA and FBI warned of two critical vulnerabilities in PHP, the programming language behind a large share of the web, reinforcing expectations that growing AI capabilities will drive long-term demand for security products. CrowdStrike (CRWD) rose 5.3% and Palo Alto Networks (PANW) about 2% on the day. Zscaler (ZS) gained 7.8%, and the cybersecurity ETFs HACK and CIBR gained 3.2% and 2.7%, according to the market summary supplied. On Thursday, Morgan Stanley reiterated Palo Alto at Overweight with a $410 price target.

Wednesday's moves

Zscaler, CrowdStrike and Okta also announced support for NVIDIA's OpenShell reference architecture for securing AI agents, according to Benzinga, and DA Davidson initiated Zscaler at Neutral with a $215 target. Cloudflare and Okta also rose sharply during the session. The Dow rose 0.69% and the Nasdaq about 1%.

The NSA and FBI warning

The FBI and NSA issued advisories Wednesday on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell." The FBI said they "could allow malicious cyber actors to remotely execute code in PHP core," and the NSA said they "often provide a direct path to the server's file system or database." PHP released fixes for versions 8.2 through 8.5; version 8.1 and older no longer receive updates from the project. The FBI recommended that organizations take affected systems offline until they are fully mitigated, and both agencies advised inventorying PHP deployments and monitoring for suspicious activity.

PHP runs content management systems such as WordPress. W3Techs estimates it is used by about 69% of websites whose server-side language is known, which does not mean all of them are vulnerable. Calif, the firm that found the flaws, said Amazon and Cloudflare reported exploitation attempts before and after public disclosure.

The AI demand argument

The market summary supplied framed the move as reinforcing expectations that growing AI capabilities will drive long-term demand for cybersecurity. Evercore ISI said the added revenue opportunity from this episode is uncertain, but that it highlights how important cybersecurity is.

Morgan Stanley's view

Morgan Stanley's bull case for Palo Alto is $497 and its bear case is $253. Long term, the bank prefers platform vendors that can consolidate enterprise security budgets. Near term, it favors traditional vendors such as Fortinet and Qualys tactically, despite their Equal-weight and Underweight ratings, ahead of earnings and on the potential for short covering, while staying balanced on Tenable and more cautious on Check Point and Rapid7. The bank flagged 2027 as the risk: it forecasts Fortinet's product revenue growth slowing from 30.7% in 2026 to 3.8% in 2027, and Rapid7's 2027 revenue falling 1.7%. Companies in its coverage are up about 33% this year, and the sector about 42%.

Sources: FBI and NSA advisories (Oct. 21); the PHP project's security advisory; Morgan Stanley research note (Oct. 22); Yahoo Finance, Benzinga and TipRanks market coverage; Newsweek. Zscaler and ETF moves are as given in the market summary supplied; CrowdStrike and Palo Alto closes are from the Morgan Stanley note. This is informational, not a recommendation to buy or sell.