Ransomware crews are inside Palo Alto Networks' GlobalProtect VPN; the stock is 97 times forward earnings

The lock is the way in

The hardest break-in to spot arrives on a session the victim's own gateway issued. On October 11 ReliaQuest reported ransomware crews↗ including Qilin and Settra exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks'▲+5.14% — Palo Alto Networks, up 5.14 percent today GlobalProtect and Prisma Access, to open VPN sessions without credentials ¹. The traffic reads as ordinary remote work while Cobalt Strike, BloodHound and SharpHound map the interior, and defenders are told to hunt connections from devices answering to the hostname "kali" ¹.

The re-rate, in numbers

The market pays this vendor as the AI-security winner. Palo Alto closed October 8 at $398.42, up 21.03% in a month against the S&P 500's 1.15%, at 97.06 times forward earnings where the security industry averages 55.51 ². The shares have nearly doubled this year on AI-threat demand ⁷.

Five months open, three to go

The flaw is picky: it needs authentication-override cookies plus a specific certificate setup, and Panorama and Cloud NGFW are unaffected ¹. It was live fast anyway. Rapid7 clocked exploitation on May 17, four days after disclosure, in gateways that trusted decrypted cookies without signature checks ³, and CISA listed the bug on May 29↗ ³. Arctic Wolf tied June intrusions ending in domain-wide Qilin encryption to the same flaw ⁴, with more than 167,000 GlobalProtect instances exposed online ⁴. ReliaQuest expects three more months as crews and initial access brokers hunt unpatched systems, and patching never evicts access gained before the fix ¹.

What 97x is buying

Fiscal Q4 told both stories at once. Revenue hit $3.41 billion, up 34%, and next-generation security ARR rose 63% to $9.10 billion ⁶. The GAAP line lost $282 million against a $254 million profit a year earlier, and goodwill jumped from $4.6 billion to $22.0 billion as the $25 billion CyberArk deal landed ⁶⁷. The October-quarter guide of $3.30 billion to $3.31 billion↗ is the floor under the 33.62% consensus ²⁶.

The other side of the trade

Arora's case is real: accelerating AI attacks force upgrades, customer briefings have run past 2,000 since the AnthropicPVT$350B — Anthropic, private, latest valuation $350B Mythos launch, and "this is a long-term tailwind" ⁷. Qilin targets every vendor's edge gear and led all crews with 14% of second-quarter attacks ⁵. Neither fact prices a second ransomware crew on a five-month-old hole in the flagship gate.

The door to watch

The next reading is the print: $3.31 billion in revenue and $0.97 a share expected ². No source names a customer lost to this flaw and no filing ties it to a renewal, so the multiple's exposure runs unproven in both directions. Until one does, holders are paying 97 times for a vendor whose badge reader is also the door.