Palo Alto rallies on the bug inside its own firewall before the fix exists
Palo Alto confirmed on October 24 that both AI-found PHP2Shell flaws run inside its own firewalls, with hotfixes only scheduled, while the stock had already rallied 7.22% on a survey calling the bug a spending catalyst. The price is paying for a forecast before the fix exists.
Richard Tang · 3 min read
Palo Alto Networks+7.48% — Palo Alto Networks, up 7.48 percent today confirmed on October 24 that both PHP2Shell bugs affect every supported PAN-OS branch, while its firewall hotfixes are still only scheduled, yet its stock was quoted up 7.22% during the October 23 session on an analyst survey calling the flaw a spending catalyst 15. Investors paid for a forecast. The fix has not shipped.
The bug landed inside the security stack itself
The technical chain, briefly. Two memory-handling flaws in PHP, the language running roughly 70% of the web, were rated 9.2 critical and patched in PHP itself on October 21 23.
Reporting credits differ on the program name and who found what first: TechCrunch says Calif discovered the bugs under OpenAI$500B — OpenAI, private, latest valuation $500B and Wiz's Hack the Planet initiative, while Help Net Security says Calif found one flaw using an OpenAI model and Wiz independently found both 23. What the sources agree on is that AI helped surface flaws that had sat undetected for over a decade 37.
Because PHP is embedded in firewall and VPN code, the bug landed inside the security stack itself. Palo Alto's October 24 advisory confirms every supported PAN-OS branch plus Panorama is affected at the management interface, no special configuration needed, and that two of its own cloud services were previously affected, fixed October 21 and 22 1. Palo Alto says it is not aware of malicious exploitation of its products, though proof-of-concept exploits exist in the wild 1.
Security stocks rallied on PHP2Shell before any fix shipped
Data
| Value | |
|---|---|
| PANW | +7.22% |
| CRWD | +8.25% |
| ZS | +7.31% |
| OKTA | +5.82% |
Revenue arrives before the repair
The market's hop and the product's hop are out of sync. Evercore's channel survey says budgets firm into year-end and names Palo Alto a leading beneficiary of AI-driven security spending; that is a forecast, not bookings 4. The company's own advisory says the PAN-OS hotfixes are only scheduled: earliest estimates October 26, the rest through October 30, dates it calls estimates 1. Until then the mitigation is a paid Threat Prevention signature that requires routing management traffic through the dataplane and decrypting HTTPS, a real product but a workaround, not a repair 1.
The test dates are this week
The dates that test the premium are close, and the sources carry them. The hotfix estimates fall due October 26 to 30 1. Meanwhile exploitation is already live: Cloudflare+7.99% — Cloudflare, up 7.99 percent today counted thousands of attempts before the public announcement and millions after 6, and by late Friday Palo Alto and Trail of Bits had confirmed post-exploit compromises on an unknown target 3. Palo Alto has not yet shipped a fixed PAN-OS release, so its customers are the unpatched part of this story.
The reward question follows from the same record. TIME reports AI condensed months of vulnerability research into days, and OpenAI expects similar findings to increase sharply 7. The vendors who earn this week's rally will be the ones who turn that discovery speed into shipped fixes; the evidence for Palo Alto doing that lands, or does not, when its hotfix estimates come due 1.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
