Key Highlights

  • Cloudflare (NYSE:NET) gained about 5% to 7% on Wednesday, October 21, 2026, after its firewall began blocking exploit attempts on two critical PHP flaws at 11:02 p.m. ET the night before fixes shipped.
  • CrowdStrike Holdings (NASDAQ:CRWD) rose about 6% as OpenAI disclosed Patch the Planet, a coalition response to the flaws, and committed USD 1 billion in subsidised Daybreak security access for under-resourced defenders.
  • Zscaler (NASDAQ:ZS) gained about 5% to 7% on October 21, after an early-October investor day reaffirmed fiscal 2027 revenue of about USD 3.91 billion to USD 3.94 billion and an October 5 pact with IBM (NYSE:IBM).
  • Fortinet (NASDAQ:FTNT) was cut two notches by Arete on the same day, from Buy straight to Sell with a USD 117 target, a contrast with the rally that reflects its reliance on firewall refresh cycles.

Cloudflare (NYSE:NET): virtual patching at the web edge

Cloudflare (NYSE:NET), which runs a global network between websites and their visitors, gained about 5% to 7% on Wednesday, October 21, 2026. The trigger was a pair of critical PHP flaws that allow unauthenticated remote code execution, meaning an attacker can run commands on a server without logging in. Cloudflare said the flaw leaked before release and that attackers were altering payloads to evade its rules. Its firewall began blocking exploit attempts at 11:02 p.m. ET on Tuesday, October 20, more than ten hours before PHP shipped fixes at 9:30 a.m. ET. Press reports said government sites were pulled offline in four countries.

The mechanism is virtual patching. A web application firewall inspects each request before it reaches the customer's own server, so one rule written centrally can shield millions of unpatched sites while operators install the real fix. Government bodies that took sites offline paid for that gap in lost service, the cost the model is designed to remove. Security products are usually sold as subscriptions tied to traffic and features, so a visible save can support upgrades. The risks are that event-driven gains fade once patches are installed and that a bypass of mutated payloads would cut against the case.

CrowdStrike Holdings (NASDAQ:CRWD): detection after AI-found flaws

CrowdStrike Holdings (NASDAQ:CRWD), which sells endpoint detection and response software through its Falcon platform, rose about 6% on Wednesday, October 21, 2026. That day OpenAI published its account of Patch the Planet, a coalition it says it led for about two months, with participants including Calif, Wiz and Cloudflare and with the NSA, CERT-EU and CISA involved. Calif found one flaw using OpenAI's GPT-5.6 Sol model, and Wiz independently found both. OpenAI committed USD 1 billion in subsidised access to Daybreak, its security offering for defenders. CrowdStrike is not named among the participants.

The read-across runs through volume. If AI models find serious flaws faster, critical disclosures rise, and each one opens a window between publication and patching. Endpoint detection and response tools, which watch servers and laptops for malicious behaviour after an intrusion, are the layer that still works when a patch is late. The pledge cuts both ways: it may widen the market for AI-assisted defence, but it also places an AI lab inside a budget that security vendors usually capture. Event-driven gains in cybersecurity often fade once patching is complete.

Zscaler (NASDAQ:ZS): reaffirmed guidance and an IBM pact

Zscaler (NASDAQ:ZS), a cloud security company built on zero trust, the principle that no user or device is trusted by default, entered the PHP episode with two October catalysts in place. At its investor day in early October 2026 it reaffirmed first-quarter and fiscal 2027 guidance, including revenue of about USD 3.91 billion to USD 3.94 billion, and the shares jumped about 6% in the following session. On Monday, October 5, 2026, it announced a collaboration with IBM and its Red Hat unit to protect private applications from flaws found and exploited with frontier AI models. No revenue figures were attached to the pact.

On Wednesday, October 21, 2026, the shares gained about 5% to 7% with the sector, and DA Davidson initiated coverage at Neutral with a USD 215 target. The pact targets the patch gap, the period between disclosure of a flaw and installation of a fix. Zero trust access connects an approved user to a specific application through the cloud, so internal applications need not sit openly on the internet, whereas public websites cannot be hidden. The risks are a first-quarter report that must meet reaffirmed guidance, valuation after two strong sessions in one month and an IBM channel that is not exclusive, since IBM also works with Palo Alto Networks (NASDAQ:PANW).

Fortinet (NASDAQ:FTNT): a Sell call against the rally

Fortinet (NASDAQ:FTNT), which builds FortiGate network firewalls around its own custom chips and sells security subscriptions alongside them, was downgraded two notches by Arete on Wednesday, October 21, 2026, from Buy straight to Sell with a USD 117 price target. Arete's detailed reasoning was not made public with the rating change. The timing stood out, because the same session brought the sector rally on the PHP flaws, with CrowdStrike up about 6% and Palo Alto Networks up about 4%.

The business model explains why views can swing. Product sales of firewall appliances are recognised when shipped and follow refresh cycles, the periods when many customers replace older hardware at once, while subscription revenue follows later. When a cycle peaks, product growth can slow quickly: in August 2025 the shares fell more than 20% in a single session after management said a major refresh was roughly halfway complete. A Sell rating usually implies a target below the current price, an inference from the rating. The risk to the call is product growth that holds up in the third-quarter report due in the coming weeks.

Where Things Stand

The answer is that the PHP flaws rewarded security models that close the patch gap without waiting for customers to patch, while hardware cycles are judged on their own terms. Cloudflare (NYSE:NET) blocked exploit attempts more than ten hours before the fix. CrowdStrike (NASDAQ:CRWD) gained as AI-led discovery points to more disclosures that need detection after an intrusion, and Zscaler (NASDAQ:ZS) offers a way to hide private applications, backed by reaffirmed guidance and the IBM pact. Arete's Sell call on Fortinet (NASDAQ:FTNT) shows that one incident does not reset a firewall refresh cycle.

With the Fed having raised rates to 3.75% to 4.00% on September 16 and the 10-year Treasury yield near 5.1%, these growth multiples stay rate sensitive. The next catalysts are the Fed decision and Microsoft results on Wednesday, October 28, 2026, the end of Zscaler's fiscal first quarter on Saturday, October 31 and the midterm elections on Tuesday, November 3. One session's move says little about future revenue, and this is not investment advice.