Palo Alto rose 6.5% the same week its own Unit 42 confirmed ransomware uses its GlobalProtect flaw
Security stocks rallied on a survey saying budgets are up. In the same 48 hours, Palo Alto's own researchers confirmed its firewall is a working ransomware doorway, and a 70,000-credential breach campaign went public.
Richard Tang · 2 min read
The security trade that lifted Palo Alto Networks+7.48% — Palo Alto Networks, up 7.48 percent today 6.5% on Friday rested on an Evercore−1.37% — Evercore, down 1.37 percent today survey of resellers seeing stronger security budgets 3. The same week, Group-IB and NyxLab published a campaign that harvested more than 70,000 credentials from FortiGate and Palo Alto GlobalProtect edge devices, and Unit 42, Palo Alto's own threat-intelligence arm, confirmed that Qilin and INC ransomware operators treat a Palo Alto authentication bypass as a reliable way in 125.
The market priced the tailwind. The vendor's researchers priced the exposure. Both were in the news at once, and only one of them says what security budgets are actually buying.
The same flaw feeds the stock and the ransomware economy
CVE-2026-0257, an authentication bypass in GlobalProtect scoring 7.8 out of 10, has been actively exploited by Qilin and INC for five months since disclosure, per Unit 42, and ReliaQuest expects more groups and access brokers to adopt it for the next three months 2. The tactic has hardened: attackers pivot from the VPN into the virtualization layer, disabling security controls on ESXi hypervisors to dump credentials off a domain controller's virtual disk, bypassing endpoint detection entirely 2.
Separately, the access broker k0t ran scripts against FortiWeb and GlobalProtect at scale, enumerated exposed appliances by product and location rather than by industry, and fed victims to Qilin and The Gentlemen leak sites 15. The firewall is now the cheapest door into a corporate network, and the crowd selling locks on that door is the crowd whose revenue rises when the door keeps failing.
Who pays at 90 times earnings
Palo Alto traded near 90x forward earnings after the move, against a five-year average of 57x, with consensus already at the top of its own September guidance: $14.1–14.2 billion in FY2027 revenue, but only 9% EPS growth as diluted shares rise about 11% 3. A reseller survey measures sentiment, not deals.
November's report has to show the spending; until then, buyers of this week's rally are paying entry prices for a threat story whose most concrete datapoint is their vendor's product being breached 35. We covered the PHP2Shell virtual-patch controversy earlier this week (theinference.com/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch); the GlobalProtect bypass now in ransomware use is a different flaw, with a different clock 35.
Security stocks rallied up to 11% on one reseller survey
Data
| Value | |
|---|---|
| SailPoint | +11% |
| CrowdStrike | +6.7% |
| Palo Alto Networks | +6.5% |
| Cloudflare | +6% |
| Okta | +5% |
| Zscaler | +4% |
The judgment: cybersecurity spending is real and rising, and learning to work with security AI is worth starting today. But this week's bid assumes every breach converts into revenue at a multiple that already assumes more. The vendor whose firewall is the entry point earns twice, as defender and as incident responder. Read the November numbers before paying 90x for both sides of that trade.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
