Industry overview

A flaw in PHP, the programming language that runs roughly 70% of websites, put millions of sites on alert last week. Operators faced a difficult choice: take a site offline and lose customers and business, or leave it running with a flaw that could let an attacker take over the server without a password.

A repair had been scheduled for Thursday, Oct. 22, but word of the flaws began spreading online two days earlier, so the PHP team brought the release forward to Wednesday, leaving companies preparing easy-to-install updates with one less day. The NSA recommended taking affected systems offline if they could not be updated or otherwise secured right away, and many organizations did just that.

After the earlier release was announced, a security firm mistakenly published a demonstration video, revealing additional clues. Even after the original was deleted, copies kept circulating. By Wednesday, purported exploits for the vulnerabilities, dubbed “PHP2Shell,” were circulating, although the PHP team said it had not identified a working public exploit at the time of release.

Finding the flaw was only half the job: the repair still had to reach operators in a form they could install quickly. That work fell in part to Ondřej Surý, a volunteer maintainer in Czechia, who had been notified earlier that week and also had one less day to prepare. The Atlantic described him as “The Man Who Saved the Internet Yesterday.”

Artificial intelligence helped bring the emergency to light. OpenAI says researchers at security firm Calif used its AI to uncover the PHP flaw, while researchers at Google’s Wiz independently found and reported the vulnerabilities known as PHP2Shell. The same capability cuts the other way: attackers using AI could find and exploit a weakness before defenders can fix it, cutting power across several cities, shutting down multiple ports, or disrupting communications at military bases.

For businesses, that could mean spending sooner than planned. Many companies keep software that has worked for years because employees know how to use it and customers depend on it, but once a weakness is found, the company has to find every computer using that software and update it without stopping employees from doing their jobs. AI can help find the problem, but people still have to get it fixed. As weaknesses become easier to find, companies need to respond faster, and the author argues AI will move more of that work from “we’ll get to it” to “we need to pay for this now.”

Fortinet Inc. (FTNT) is presented as one company worth considering. It helps businesses protect their computers and the connections between them, brings many security tools together so a business can manage more of its security in one place, and had already released protection against PHP2Shell. In the third quarter of 2026, Fortinet reported $2.08 billion in revenue, up 20% from a year earlier. The author cautions that Fortinet has competitors and investors still have to be careful about what they pay for the stock, but says it is worth a closer look, including its work with factories and other industrial customers.

The risk extends beyond websites into critical infrastructure. Computers in a factory or a power company may help run machinery, check equipment, or keep an essential service working, so if they stop working properly, production could stop and damage could reach far beyond a website that will not load. The NSA warned about risks to government and national security computers, and the United States and its allies need better protection against hackers and stronger defenses against physical attacks, including drones that can fly without someone steering them. Designing and building that equipment means making parts, building and testing finished products, and delivering enough of them to do the job.

In July, government, technology, finance, and military leaders gathered at the U.S. Army War College, and Sen. Dave McCormick’s office reported more than $10 billion in new investment commitments. Those commitments still have to turn into completed projects, but they show where money is moving, and every new production line needs equipment, parts, and materials.

Industry overview based on InvestorPlace.

What it means for investors

For investors, PHP2Shell is a reminder that cybersecurity spending is not optional or easy to postpone. When a flaw can take over a server without a password, the cost of waiting can be far higher than the cost of patching, so budgets planned for later in the year can be pulled forward quickly. That favors companies with proven products and growing sales, like Fortinet, which reported $2.08 billion in third-quarter 2026 revenue, up 20% from a year earlier, and already had protection out for this flaw.

Still, a strong quarter is not a reason to buy at any price. Fortinet has competitors, and the market will judge whether customers keep spending and sales growth continues. The wider opportunity may also sit beyond software, in companies that make parts, materials, and equipment for factories, power plants, and defense, especially with more than $10 billion in new investment commitments reported after the July gathering at the U.S. Army War College. Those commitments are not yet completed projects, so investors should watch for new orders and expanding factories rather than assuming every supplier will benefit equally.

What it means for employees

For employees in IT and security teams, this kind of incident means urgent, high-pressure work. Staff must find every affected computer, test and install updates, watch for signs of a break-in, and keep the business running at the same time. Website operators face the same trade-off their employers faced: stay online and risk exposure, or go offline and deal with frustrated customers.

Longer term, the shift is favorable for workers in cybersecurity, systems administration, and industrial technology. As AI makes flaws easier to find, companies need people who can respond faster, use security tools well, and protect factories and power systems as well as websites. That work is growing, but it also brings tighter deadlines and less room to defer maintenance.

What it means for customers

For customers, the immediate effect is the risk of disruption either way. A website taken offline is unavailable, while a website left running with an unpatched flaw risks a takeover that could expose data or shut down a service. Most customers will never see the patching work, but they feel it when a site, a store, or an essential service stops working.

The infrastructure angle matters even more. If a factory or power company is hit, the impact is not just a page that will not load; production can stop and essential services can be interrupted. Better protection, faster updates, and equipment that can spot threats such as drones should make those services more reliable, but that protection has a cost, and some of it may eventually show up in the prices businesses charge.

Note: Investment calculations and projections are for illustrative purposes only. Market conditions change frequently. Consult a qualified financial advisor before making investment decisions.