Why can a vulnerability incident reverse caution ahead of earnings?

  • The PHP2Shell incident drove cybersecurity stocks higher, supporting Morgan Stanley’s continued positive view of the industry: major vulnerabilities can raise enterprises’ need for protection at any time, particularly as the threat environment becomes more severe following the testing of more advanced AI models.
  • But the bar for earnings has not been lowered. The sector rose rapidly over the preceding three months, while the bank expects only gradual improvement in results in the third quarter of 2026, prompting investors to become cautious. Morgan Stanley agrees that some companies’ share prices could adjust to their valuations the day after earnings; the event-driven positive outlook and near-term earnings pressure coexist.

Why is this vulnerability difficult for applications to defend against on their own?

  • Two critical PHP vulnerabilities were disclosed on 20 October, ahead of the patch release originally scheduled for the 22nd. PHP is used by approximately 70% of websites, making the potential exposure extensive; the vulnerabilities lie in the underlying software that runs PHP code. Under certain configurations, an attack can occur before application code runs, so securely written application code cannot eliminate the underlying risk.
  • The patching gap prompted the US National Security Agency to recommend taking systems that could not be updated immediately offline, while the Dutch cybersecurity agency and others also shut down websites as a precaution. Emergency patches have now been released and can reduce the risk of exploitation once installed; enterprises still need to identify all affected deployments, complete updates and confirm that the fixes have reached production environments.

How can WAFs turn the remediation lag into a business opportunity?

  • A web application firewall (WAF) inspects traffic before requests reach a PHP application and, when properly configured, can block malicious requests, buying time to deploy patches. Morgan Stanley considers this the most direct potential beneficiary in the near term; temporary protection must still be paired with fixes to the underlying software.
  • Cloudflare had deployed relevant WAF protection by default to free and paid customers approximately nine hours before the vulnerabilities were disclosed. The bank values its position on the application traffic path, which enables it to distribute protection centrally before customers complete underlying updates; this coverage also included free users, with the commercial opportunity primarily pointing to increased value for its application security business.
  • Akamai’s customer activity more directly reflects purchasing demand. Management said enterprises are urgently moving entire applications under its WAF protection, including a 14 million dollar security upgrade for a global bank. Patching windows at complex enterprises can last weeks, making its ability to update rules quickly across its edge network more valuable.

Where will security budgets flow first?

  • Morgan Stanley expects more immediate spending in 2026 to come from upgrades to legacy infrastructure and the use of AI to accelerate security investigations, detection and response. The logic is that, as vulnerability discovery and attack development accelerate, enterprises must not only find problems but also locate affected systems, fix them promptly and maintain operations, increasing demand for firewalls, endpoint protection, vulnerability management and security operations tools.
  • Providing security for enterprises’ own AI deployments is a separate line of demand. Spending on agent identity, data protection and prompt security has begun to emerge, but the bank expects it to reach a more substantial scale only in 2027; the PHP incident first increases the urgency of protecting existing technology systems.