Cloudflare leads cyber stock rally as PHP flaws hit sites

Cybersecurity and software stocks rallied on Wednesday, October 21, after two critical flaws in the PHP programming language led governments, hospitals and businesses across Europe to take their websites offline. Cloudflare ↗ 5.32% climbed more than 6%. Datadog ↗ 6.50%, Okta ↗ 7.54%, Zscaler ↗ 7.84% and CrowdStrike ↗ 5.26% also rose, TradingKey reported. Palo Alto Networks ↗ 2.05% gained as well, according to Investing.com.tradingkey.com+1

Investors focused on Cloudflare because its web application firewall stands between attackers and millions of PHP sites, Investing.com noted. Not all of the gains came from the PHP news. StockStory tied part of the software rally to a shift of money out of semiconductor stocks, and to Nvidia's ↗ 2.54% new AI-agent security architecture, which CrowdStrike, Okta and Zscaler said they would support, according to StockStory.tradingview.com+1

A scramble to patch

PHP's developers disclosed two critical vulnerabilities on Tuesday. They said a fix went live around 1345 GMT on Wednesday, CNBC reported. Both flaws are rated 9.2 on the CVSS v4.0 severity scale. CERT-EU, the EU's cybersecurity response team, said that rating points to unauthenticated remote code execution, meaning attackers could run commands on a server without logging in, Reuters reported. The bugs affect web servers running PHP 5.4 or later and are fixed in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to KrebsOnSecurity.cnbc.com+2

Before the patch was released, many organizations took their sites down as a precaution. In the Netherlands these included the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB and the national cyber agency itself. Germany's federal IT provider ITZBund, France's prefectures and Finland's government web services also went offline, Reuters reported. The Wikimedia Foundation said it had taken several systems down until they could be patched.rmb.reuters.com

Exposure and early attacks

PHP runs about three-quarters of the websites whose programming language can be identified. It also powers WordPress, which runs about 43% of all sites, The Next Web reported, citing W3Techs. Cloudflare Chief Technology Officer Dane Knecht said the company was already seeing early attacks and was updating its firewall rules as a temporary measure. Belgian, Finnish and Australian agencies said they had not seen any exploitation.thenextweb.com

The U.S. National Security Agency warned that flaws like these "often provide a direct path to the server's file system or database," Le Monde reported. Wordfence, which makes a WordPress security plugin, warned that WordPress's usual automatic updates will not apply this fix. That could leave small sites on shared hosting exposed for longer, Reuters reported.charlotteobserver.com+1