Palo Alto Networks, CrowdStrike, Okta and Snowflake led a broad slide in software shares while utilities, energy and consumer staples rose. A Palo Alto security flaw being blamed was disclosed on Wednesday, when Palo Alto's own shares had already fallen 5.5%.
Friday's market was a two-speed affair, and the fast lane ran downhill.
By early afternoon, the iShares Expanded Tech-Software ETF was down 4.7%, and two cybersecurity ETFs fell by similar amounts. Palo Alto Networks dropped 7.5%, CrowdStrike 7.0%, Fortinet 7.8%, Zscaler 6.7%, Okta 10.1% and SentinelOne 9.0%. Data and cloud software names were hit as hard: Snowflake fell 9.1%, Datadog 7.8%, Cloudflare 7.1%, Palantir 6.9% and ServiceNow 4.9%. Microsoft lost 2.0% and Meta 3.3%.
The broad market held up better. The S&P 500 was down about 0.9%, the Nasdaq about 1.9%, and the Dow only about 0.3%. Utilities rose 1.3%, energy 2.1% and consumer staples 0.9%. The Cboe Volatility Index rose to about 19, after touching 22.31.
The timeline problem
The explanation circulating for the cybersecurity leg is a vulnerability in Palo Alto Networks' PAN-OS software. That flaw, CVE-2026-0322, was published and added to the U.S. Cybersecurity and Infrastructure Security Agency's catalogue of known exploited vulnerabilities on Wednesday, Oct. 14, two days before Friday's drop.
The market did react at the time. Palo Alto shares fell 5.5% on Wednesday and another 1.3% on Thursday, and CrowdStrike lost 4.6% and 1.9%, while the software ETF rose 1.8% on Thursday. A further leg down two days later does not rule out a link, since investors sometimes take time to judge how widely a flaw has been exploited. But it does not explain a broad selloff on Friday. And it cannot explain why Snowflake, Datadog and Palantir, which do not sell firewalls, fell as much as the security companies did.
No company in the group issued news on Friday that would account for the declines.
What the pattern looks like
Among the sharpest decliners were high-growth software names, AI-infrastructure stocks such as CoreWeave, and bitcoin miners that host computing capacity. The gainers were defensive sectors with steady cash flows. That pattern is consistent with investors cutting exposure to long-duration growth stories and moving into income, though the trades themselves do not say why.
The macro calendar offered little. Import prices and industrial output came in hotter than expected, yet the 10-year Treasury yield traded in early afternoon near its 5.10% Thursday close, and futures pushed the odds of an October Fed rate increase down to about 15%.
Market implications
One reading is that the AI financing worry is spreading from a handful of leveraged infrastructure borrowers into the software stocks priced for AI-driven growth. On Wednesday, as chip stocks slid, Ulrike Hoffmann-Burchardi of UBS's Chief Investment Office called the AI selloff "more of a recalibration of expectations than a fundamental break in the AI investment story." A recalibration can still take software valuations meaningfully lower.
A second reading is that this is positioning, not a verdict. James Athey of Marlborough has pointed to bullish outcomes accompanied by falling stocks as a sign of crowded positioning. On that view, Friday was an unwind into the weekend, and the companies' fundamentals will reassert themselves when they report.
The risk for investors is treating very different businesses as one trade. Firewall makers, data platforms and AI cloud providers have different customers, margins and balance sheets, even when they fall on the same day.
What to watch
Any statement from Palo Alto quantifying customer impact from the flaw, the software group's close relative to Friday's lows, and the October earnings season for software companies, which starts later this month. If the selloff continues without company news, the positioning reading weakens.