--- title: "Tenable's Q4 guide leaves out PHP2Shell demand, and CERT-FR flagged a 9.9 flaw in Tenable's own product" description: "Tenable beat its third quarter and ran nine sessions to a one-year high, but its own fourth-quarter guide prices the AI-and-PHP2Shell demand story at zero, and France's CERT-FR just flagged a 9.9 flaw in the company's identity product." publisher: "The Inference" section: "Security" published: 2026-11-03T17:07:23.706Z modified: 2026-11-03T17:07:23.706Z canonical: https://theinference.org/article/tenable-s-q4-guide-leaves-out-php2shell-demand-and-cert-fr-flagged-a-9-9-flaw-in-tenable-s-own-product language: en keywords: "Tenable, Earnings, Guidance, Cybersecurity, PHP2Shell" --- # Tenable's Q4 guide leaves out PHP2Shell demand, and CERT-FR flagged a 9.9 flaw in Tenable's own product > Tenable beat its third quarter and ran nine sessions to a one-year high, but its own fourth-quarter guide prices the AI-and-PHP2Shell demand story at zero, and France's CERT-FR just flagged a 9.9 flaw in the company's identity product. Steve Vintz, co-CEO of exposure-management software maker [Tenable](https://theinference.org/markets/companies/tenable), had a story ready when the company [reported third-quarter results on October 28](https://tenablenetworksecurity.gcs-web.com/news-releases/news-release-details/tenable-announces-third-quarter-2026-financial-results/): [a critical PHP flaw called PHP2Shell](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/), disclosed the week before, would be "[a good durable tailwind of growth](https://www.bullished.co/tenable-co-ceo-says-php2shell-had-little-impact-on-the-quarter-but-sees-a-durable-tailwind-294c62fa/)" even though it had "little impact in the quarter just given the timing." [1][2] The market bought it. The stock ran nine sessions to $51.94, a one-year high, up about 107% year to date. [7] ## The tailwind has no number yet The quarter itself was clean. Revenue of $276.4 million, up 9.5%; non-GAAP operating margin of 27.1%, up 380 basis points; adjusted earnings of $0.63, including a one-time $0.03 tax benefit. [1][2] The AI argument is visible in how customers buy: dollar-based net expansion rose to 107%, the second straight quarterly improvement in more than four years, and Tenable One took a record 59% of new business. [1][2][4] *Chart: **Tenable One went from 39% of new business to a record 59% in a year** Column chart showing Tenable One's share of new business rising from 39% in Q3 2025 to 50% in Q2 2026 to a record 59% in Q3 2026.* *Tenable One went from 39% of new business to a record 59% in a year [2]* But PHP2Shell demand, Vintz said, is "too early to quantify right now." [2] Hexa AI prompt volume rose as much as fivefold after the disclosure, and the flaw itself is real: two PHP remote-code-execution bugs, CVSS 9.2, unpatched for 14 years, exploitable because frontier AI models chained the steps. [2][8] ## The guide prices the tailwind at zero Q4 revenue is guided to $277.0-280.0 million, roughly flat on Q3, and adjusted EPS to $0.56-0.58, below the $0.63 just delivered. [1] The company also closed an upsized $800 million convertible note and a $400 million revolver; of $223.8 million in buybacks, $170.5 million merely offset the convert. [1][2] On November 2, France's CERT-FR [flagged three flaws in Tenable's own Identity Exposure product](https://armees.com/tenable-identity-exposure-anssi-trois-failles-reinstaller-ioa-20261102-2336/), worst scored 9.9, needing a domain-controller reinstall. [3] [A Form 144 insider-sale notice](https://ca.investing.com/news/stock-market-news/form-144-tenable-holdings-for-3-november-93CH-4925317) landed on November 3. [6] *Chart: **Q4 guidance is the flattest quarter in two years, after nine straight quarters of growth** Column chart of Tenable's quarterly revenue from Q3 2024 to Q2 2026, with the Q4 2026 guidance range shown as an estimate.* *Quarterly revenue in $ millions. Q3 2026 actual per the company's press release; Q4 2026 is guidance, plotted at the $278.5 million midpoint of the $277.0-280.0 million range. Sources: [1][9] [1][9]* ## The reading on December 10 CFO Matt Brown expects expansion to hold at 107% in Q4, "the first number that will show whether the PHP2Shell demand is real." [2] [At $47.45, down 6.5% Monday on no news](https://www.debelegger.nl/en/stock/TENB.US), the stock pays for an inflection the guide does not yet confirm. [5] ## Takeaway Tenable's Q4 guide gives the PHP2Shell demand story no room: revenue flat, EPS below Q3, and a December 10 print that will show whether the AI tailwind is real. ## Sources 1. [Tenable press release, Tenable Announces Third Quarter 2026 Financial Results, 28 October 2026](https://tenablenetworksecurity.gcs-web.com/news-releases/news-release-details/tenable-announces-third-quarter-2026-financial-results/) 2. [Bullished, Tenable Co-CEO Says PHP2Shell Had 'Little Impact' On The Quarter, But Sees A 'Durable Tailwind', 3 November 2026](https://www.bullished.co/tenable-co-ceo-says-php2shell-had-little-impact-on-the-quarter-but-sees-a-durable-tailwind-294c62fa/) 3. [Armees.com, Tenable Identity Exposure : l'ANSSI alerte sur trois failles, 2 November 2026](https://armees.com/tenable-identity-exposure-anssi-trois-failles-reinstaller-ioa-20261102-2336/) 4. [Yahoo Finance/Benzinga, Dan Ives Sees More Upside for This $5 Billion Cybersecurity Company, 2 November 2026](https://finance.yahoo.com/technology/ai/articles/dan-ives-sees-more-upside-193005147.html) 5. [De Belegger, Tenable Holdings (TENB) Stock Price, Chart & Analysis, 2 November 2026](https://www.debelegger.nl/en/stock/TENB.US) 6. [Investing.com/Reuters, Form 144 Tenable Holdings For: 3 November, 3 November 2026](https://ca.investing.com/news/stock-market-news/form-144-tenable-holdings-for-3-november-93CH-4925317) 7. [Bullished, Tenable Stock Surges 7%, Adding $355 Million, After Lifting Its Full-Year Outlook, 2 November 2026](https://www.bullished.co/tenable-stock-surges-7-adding-355-million-after-lifting-its-full-year-outlook-18d5dd11/) 8. [Help Net Security, PHP2Shell: Critical PHP vulnerabilities patched, update now!, 21 October 2026](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/) 9. [Tenable, quarterly figures from its SEC filings, retrieved 3 November 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001660280) --- Tenable's Q4 guide leaves out PHP2Shell demand, and CERT-FR flagged a 9.9 flaw in Tenable's own product — The Inference. Canonical: https://theinference.org/article/tenable-s-q4-guide-leaves-out-php2shell-demand-and-cert-fr-flagged-a-9-9-flaw-in-tenable-s-own-product