Tenable's Q4 guide leaves out PHP2Shell demand, and CERT-FR flagged a 9.9 flaw in Tenable's own product
Tenable beat its third quarter and ran nine sessions to a one-year high, but its own fourth-quarter guide prices the AI-and-PHP2Shell demand story at zero, and France's CERT-FR just flagged a 9.9 flaw in the company's identity product.
Vincent Jiang · 2 min read
Steve Vintz, co-CEO of exposure-management software maker Tenable+0.24% — Tenable, up 0.24 percent today, had a story ready when the company reported third-quarter results on October 28: a critical PHP flaw called PHP2Shell, disclosed the week before, would be "a good durable tailwind of growth" even though it had "little impact in the quarter just given the timing." 12 The market bought it. The stock ran nine sessions to $51.94, a one-year high, up about 107% year to date. 7
The tailwind has no number yet
The quarter itself was clean. Revenue of $276.4 million, up 9.5%; non-GAAP operating margin of 27.1%, up 380 basis points; adjusted earnings of $0.63, including a one-time $0.03 tax benefit. 12 The AI argument is visible in how customers buy: dollar-based net expansion rose to 107%, the second straight quarterly improvement in more than four years, and Tenable One took a record 59% of new business. 124
Tenable One went from 39% of new business to a record 59% in a year
Data
| Tenable One share of new business (%) | |
|---|---|
| Q3 2025 | 39 |
| Q2 2026 | 50 |
| Q3 2026 | 59 |
But PHP2Shell demand, Vintz said, is "too early to quantify right now." 2 Hexa AI prompt volume rose as much as fivefold after the disclosure, and the flaw itself is real: two PHP remote-code-execution bugs, CVSS 9.2, unpatched for 14 years, exploitable because frontier AI models chained the steps. 28
The guide prices the tailwind at zero
Q4 revenue is guided to $277.0-280.0 million, roughly flat on Q3, and adjusted EPS to $0.56-0.58, below the $0.63 just delivered. 1 The company also closed an upsized $800 million convertible note and a $400 million revolver; of $223.8 million in buybacks, $170.5 million merely offset the convert. 12 On November 2, France's CERT-FR flagged three flaws in Tenable's own Identity Exposure product, worst scored 9.9, needing a domain-controller reinstall. 3 A Form 144 insider-sale notice landed on November 3. 6
Q4 guidance is the flattest quarter in two years, after nine straight quarters of growth
- Revenue ($M)
- Estimate
Data
| Revenue ($M) | |
|---|---|
| Q3 '24 | $227.09M |
| Q4 '24 | $235.73M |
| Q1 '25 | $239.14M |
| Q2 '25 | $247.3M |
| Q3 '25 | $252.44M |
| Q4 '25 | $260.53M |
| Q1 '26 | $262.06M |
| Q2 '26 | $268.51M |
| Q3 '26 | $276.4M |
| Q4 '26 (estimate) | $278.5M ($277–280M) |
The reading on December 10
CFO Matt Brown expects expansion to hold at 107% in Q4, "the first number that will show whether the PHP2Shell demand is real." 2 At $47.45, down 6.5% Monday on no news, the stock pays for an inflection the guide does not yet confirm. 5
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
