---
title: "Palo Alto rose 6.5% the same week its own Unit 42 confirmed ransomware uses its GlobalProtect flaw"
description: "Security stocks rallied on a survey saying budgets are up. In the same 48 hours, Palo Alto's own researchers confirmed its firewall is a working ransomware doorway, and a 70,000-credential breach campaign went public."
publisher: "The Inference"
section: "Security"
published: 2026-10-24T16:09:01.854Z
modified: 2026-10-24T16:09:01.854Z
canonical: https://theinference.org/article/palo-alto-rose-6-5-the-same-week-its-own-unit-42-confirmed-ransomware-uses-its-globalprotect-flaw
language: en
keywords: "Cybersecurity, Palo Alto Networks, Ransomware, Stock Moves, Valuation"
---

# Palo Alto rose 6.5% the same week its own Unit 42 confirmed ransomware uses its GlobalProtect flaw

> Security stocks rallied on a survey saying budgets are up. In the same 48 hours, Palo Alto's own researchers confirmed its firewall is a working ransomware doorway, and a 70,000-credential breach campaign went public.

The security trade that lifted [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks) 6.5% on Friday rested on an [Evercore](https://theinference.org/markets/companies/evercore) survey of resellers seeing stronger security budgets [3]. The same week, Group-IB and NyxLab [published a campaign that harvested more than 70,000 credentials](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html) from FortiGate and Palo Alto GlobalProtect edge devices, and Unit 42, Palo Alto's own threat-intelligence arm, [confirmed that Qilin and INC ransomware operators treat a Palo Alto authentication bypass as a reliable way in](https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/) [1][2][5].

The market priced the tailwind. The vendor's researchers priced the exposure. Both were in the news at once, and only one of them says what security budgets are actually buying.

## The same flaw feeds the stock and the ransomware economy

CVE-2026-0257, an authentication bypass in GlobalProtect scoring 7.8 out of 10, has been actively exploited by Qilin and INC for five months since disclosure, per Unit 42, and ReliaQuest expects more groups and access brokers to adopt it for the next three months [2]. The tactic has hardened: attackers pivot from the VPN into the virtualization layer, disabling security controls on ESXi hypervisors to dump credentials off a domain controller's virtual disk, bypassing endpoint detection entirely [2].

Separately, the access broker k0t ran scripts against FortiWeb and GlobalProtect at scale, enumerated exposed appliances by product and location rather than by industry, and [fed victims to Qilin and The Gentlemen leak sites](https://www.msn.com/en-us/news/other/k0t-campaign-exposes-70000-credentials-and-possible-ransomware-access-pipeline/ar-AA2fXgnT) [1][5]. The firewall is now the cheapest door into a corporate network, and the crowd selling locks on that door is the crowd whose revenue rises when the door keeps failing.

## Who pays at 90 times earnings

Palo Alto traded near 90x forward earnings after the move, against a five-year average of 57x, with [consensus already at the top of its own September guidance: $14.1–14.2 billion in FY2027 revenue](https://www.tikr.com/blog/palo-alto-and-crowdstrike-jumped-6-and-okta-up-5-as-evercore-survey-flags-stronger-cyber-demand), but only 9% EPS growth as diluted shares rise about 11% [3]. A reseller survey measures sentiment, not deals.

November's report has to show the spending; until then, buyers of this week's rally are paying entry prices for a threat story whose most concrete datapoint is their vendor's product being breached [3][5]. We covered [the PHP2Shell virtual-patch controversy](https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch) earlier this week (theinference.com/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch); the GlobalProtect bypass now in ransomware use is a different flaw, with a different clock [3][5].

*Chart: **Security stocks rallied up to 11% on one reseller survey** Bars showing Oct 23, 2026 gains: SailPoint 11%, CrowdStrike 6.7%, Palo Alto 6.5%, Cloudflare 6%, Okta 5%, Zscaler 4%, after the Evercore survey.*

*One-day share price moves on October 23, 2026, following Evercore ISI's channel-partner survey, as reported by TIKR. Palo Alto Networks highlighted. Sources: TIKR [3][4]. [3][4]*

The judgment: cybersecurity spending is real and rising, and learning to work with security AI is worth starting today. But this week's bid assumes every breach converts into revenue at a multiple that already assumes more. The vendor whose firewall is the entry point earns twice, as defender and as incident responder. Read the November numbers before paying 90x for both sides of that trade.

## Takeaway

Security budgets are rising, but this week's 6.5% rally in Palo Alto Networks prices deals a survey cannot show, while Unit 42 confirmed ransomware exploiting its GlobalProtect flaw; read November's results before paying 90x forward earnings.

## Sources

1. [The Hacker News, 'Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials', 23 October 2026](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html)
2. [Cybersecurity Dive, 'Ransomware groups expand targeting of Palo Alto Networks vulnerability', 20 October 2026](https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/)
3. [TIKR, 'Palo Alto and Crowdstrike Jumped 6%, and Okta Up 5% as Evercore Survey Flags Stronger Cyber Demand', 23 October 2026](https://www.tikr.com/blog/palo-alto-and-crowdstrike-jumped-6-and-okta-up-5-as-evercore-survey-flags-stronger-cyber-demand)
4. [TIKR, 'SailPoint Soars 11%, Palo Alto Up 6%, CrowdStrike Up 6% as Cybersecurity Stocks Rally', 23 October 2026](https://www.tikr.com/blog/sailpoint-soars-11-palo-alto-up-6-crowdstrike-up-6-as-cybersecurity-stocks-rally)
5. [Cryptopolitan (via MSN), 'k0t campaign exposes 70,000 credentials and possible ransomware access pipeline', 23 October 2026](https://www.msn.com/en-us/news/other/k0t-campaign-exposes-70000-credentials-and-possible-ransomware-access-pipeline/ar-AA2fXgnT)


---

Palo Alto rose 6.5% the same week its own Unit 42 confirmed ransomware uses its GlobalProtect flaw — The Inference. Canonical: https://theinference.org/article/palo-alto-rose-6-5-the-same-week-its-own-unit-42-confirmed-ransomware-uses-its-globalprotect-flaw