Cybersecurity stocks are rising due to a new threat. Which ones aren't too late to buy?

Shares of cybersecurity companies have been rising over the past few days following the discovery of a vulnerability that affects about 70% of all web hosting services on the Internet. AI agents from several research labs simultaneously discovered security flaws in one of the most widely used web server languages—PHP. The need for updates and the threat of AI attacks have forced companies and government agencies around the world to temporarily take their websites offline.

Barron’s notes that these concerns could boost demand for products across the entire sector—from comprehensive corporate cybersecurity platforms to solutions for protecting web applications and edge infrastructure. Many of these stocks have already risen sharply in 2026. Fastly’s stock has risen by about 125%, while CrowdStrike and Palo Alto Networks have roughly doubled in value. However, Wall Street estimates that the future upside potential for these stocks varies considerably.

Cloudflare, which protects websites and internet traffic through its cloud infrastructure, has a “buy” rating from 73% of analysts surveyed by FactSet. The average price target of $311 implies a gain of just 2.5% from the October 22 closing price. Palo Alto Networks, one of the largest providers of enterprise cybersecurity platforms, also has a 73% “buy” rating, but its upside potential is approximately 13% with a target price of $404.4.

CrowdStrike, which specializes in protecting user devices and cloud infrastructure and detecting cyberattacks, has 74% “bullish” ratings, according to FactSet; however, the average price target of $248.6 implies only about 5% growth. The proportion of buy recommendations for Zscaler, a provider of cloud solutions that enable secure employee access to corporate systems and the internet, is the same, and the upside potential is only about 1%, with a Wall Street consensus target price of $233.3.

According to Fastly, which speeds up website loading times and protects web applications from attacks, analysts’ ratings are split roughly evenly between “buy” and “hold,” with an average price target of $26.50 implying an expected 18% increase—the highest among the companies listed by Barron’s.

Shares of Tenable, which specializes in identifying and managing vulnerabilities in corporate IT systems, are underperforming the rest: Most analysts recommend holding them in the portfolio, and the average price target of $36 is 14% below the current price.

All of the stocks mentioned above rose during Wednesday's trading session. On Thursday, some of them slipped into negative territory, but they fared much better than the rest of the tech sector: the First Trust Nasdaq Cybersecurity ETF lost 0.3%, while the Nasdaq Composite plunged 2.6%.

Using AI, researchers discovered that all servers running any version of PHP released over the past 20 years are potentially vulnerable. According to Cloudflare, attempts to exploit the vulnerability began even before it was officially disclosed, but initially there were only thousands of attacks; after the PHP2Shell threat was made public, the number rose to tens of thousands within 45 minutes, and to hundreds of thousands within two hours, and then to millions.

This article was AI-translated and verified by a human editor