--- title: "Ransomware crews are inside Palo Alto Networks' GlobalProtect VPN; the stock is 97 times forward earnings" description: "Qilin and now Settra have spent five months opening unauthenticated VPN sessions through GlobalProtect, and ReliaQuest expects three more. At 97 times forward earnings, Palo Alto's stock is priced as if the gate holds." publisher: "The Inference" section: "Safety" published: 2026-10-11T13:15:50.609Z modified: 2026-10-11T13:15:50.609Z canonical: https://theinference.org/article/ransomware-crews-are-inside-palo-alto-networks-globalprotect-vpn-the-stock-is-97-times-forward-earnings language: en keywords: "Cybersecurity, Palo Alto Networks, Ransomware, VPN, Valuation" --- # Ransomware crews are inside Palo Alto Networks' GlobalProtect VPN; the stock is 97 times forward earnings > Qilin and now Settra have spent five months opening unauthenticated VPN sessions through GlobalProtect, and ReliaQuest expects three more. At 97 times forward earnings, Palo Alto's stock is priced as if the gate holds. ## The lock is the way in The hardest break-in to spot arrives on a session the victim's own gateway issued. [On October 11 ReliaQuest reported ransomware crews](https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/) including Qilin and Settra exploiting CVE-2026-0257, an authentication bypass in [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks)' GlobalProtect and Prisma Access, to open VPN sessions without credentials [1]. The traffic reads as ordinary remote work while Cobalt Strike, BloodHound and SharpHound map the interior, and defenders are told to hunt connections from devices answering to the hostname "kali" [1]. ## The re-rate, in numbers The market pays this vendor as the AI-security winner. [Palo Alto](https://theinference.org/markets/companies/palo-alto-networks) closed October 8 at $398.42, up 21.03% in a month against the S&P 500's 1.15%, at 97.06 times forward earnings where the security industry averages 55.51 [2]. The shares have nearly doubled this year on AI-threat demand [7]. ## Five months open, three to go The flaw is picky: it needs authentication-override cookies plus a specific certificate setup, and Panorama and Cloud NGFW are unaffected [1]. It was live fast anyway. Rapid7 clocked exploitation on May 17, four days after disclosure, in gateways that trusted decrypted cookies without signature checks [3], and [CISA listed the bug on May 29](https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/) [3]. Arctic Wolf tied June intrusions ending in domain-wide Qilin encryption to the same flaw [4], with more than 167,000 GlobalProtect instances exposed online [4]. ReliaQuest expects three more months as crews and initial access brokers hunt unpatched systems, and patching never evicts access gained before the fix [1]. ## What 97x is buying Fiscal Q4 told both stories at once. Revenue hit $3.41 billion, up 34%, and next-generation security ARR rose 63% to $9.10 billion [6]. The GAAP line lost $282 million against a $254 million profit a year earlier, and goodwill jumped from $4.6 billion to $22.0 billion as the $25 billion CyberArk deal landed [6][7]. [The October-quarter guide of $3.30 billion to $3.31 billion](https://finance.yahoo.com/technology/articles/palo-alto-networks-reports-fiscal-200500400.html) is the floor under the 33.62% consensus [2][6]. *Chart: **The growth the 97x trade is priced on: mid-teens to 34% in three quarters** Line chart of Palo Alto Networks quarterly revenue from Q3 2024 to a guided Q3 2026, rising from $2.14 billion to $3.41 billion, with the final quarter shown as guidance.* *Quarterly total revenue in USD billions, fiscal quarters labeled by calendar quarter; final point is company guidance of $3.30 to $3.31 billion for the October 2026 quarter. Sources: PANW SEC filings (8); fiscal Q4 2026 release (6). [6][8]* *Chart: **GAAP net income has been negative for two straight quarters as CyberArk lands** Line chart of Palo Alto Networks quarterly GAAP net income from Q1 2024 to Q2 2026: profits between $0.25 billion and $0.43 billion, then losses of $0.18 billion and $0.28 billion in the last two quarters.* *GAAP net income by calendar quarter, USD billions; Palo Alto's fiscal quarters are labeled by the calendar quarter of the period start. The July 2026 quarter, reported September 1, took goodwill from $4.6 billion to $22.0 billion with the $25 billion CyberArk acquisition. Source: PANW SEC filings (8). [8]* ## The other side of the trade Arora's case is real: accelerating AI attacks force upgrades, customer briefings have run past 2,000 since the [Anthropic](https://theinference.org/markets/companies/anthropic) [Mythos launch](https://theinference.org/article/palo-alto-rents-out-the-cyber-models-anthropic-and-openai-keep-locked), and "this is a long-term tailwind" [7]. Qilin targets [every vendor's edge gear](https://theinference.org/article/fortinet-sold-factory-security-the-same-week-the-fbi-called-its-firewalls-a-ransomware-doorway) and led all crews with 14% of second-quarter attacks [5]. Neither fact prices a second ransomware crew on a five-month-old hole in the flagship gate. ## The door to watch The next reading is the print: $3.31 billion in revenue and $0.97 a share expected [2]. No source names a customer lost to this flaw and no filing ties it to a renewal, so the multiple's exposure runs unproven in both directions. Until one does, holders are paying 97 times for a vendor whose badge reader is also the door. ## Takeaway Qilin and Settra have been opening unauthenticated GlobalProtect sessions for five months, ReliaQuest expects three more, and at 97.06 times forward earnings the stock assumes the gate holds. ## Sources 1. [CyberSecurityNews, "Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access", 11 October 2026](https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/) 2. [Zacks Equity Research via Yahoo Finance Canada, "Palo Alto Networks (PANW) Suffers a Larger Drop Than the General Market: Key Insights", 8 October 2026](https://ca.finance.yahoo.com/news/palo-alto-networks-panw-suffers-204506114.html) 3. [BleepingComputer, "Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks", 30 May 2026](https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/) 4. [BleepingComputer, "Critical Palo Alto VPN bug now exploited by Qilin ransomware gang", 21 July 2026](https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/) 5. [CSO Online, "Ransomware groups are hammering your vulnerable VPNs", 24 July 2026](https://www.csoonline.com/article/4201019/ransomware-groups-are-hammering-your-vulnerable-vpns.html) 6. [Palo Alto Networks press release via PR Newswire (Yahoo Finance), "Palo Alto Networks Reports Fiscal Fourth Quarter and Fiscal Year 2026 Financial Results", 1 September 2026](https://finance.yahoo.com/technology/articles/palo-alto-networks-reports-fiscal-200500400.html) 7. [CNBC, "Palo Alto Networks beats quarterly estimates on AI demand, continues acquisition spree", 1 September 2026](https://www.cnbc.com/2026/09/01/palo-alto-networks-panw-q4-2026-earnings.html) 8. [Palo Alto Networks, quarterly figures from its SEC filings, retrieved 11 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001327567) --- Ransomware crews are inside Palo Alto Networks' GlobalProtect VPN; the stock is 97 times forward earnings — The Inference. Canonical: https://theinference.org/article/ransomware-crews-are-inside-palo-alto-networks-globalprotect-vpn-the-stock-is-97-times-forward-earnings