Clouded Judgement 10.22.26 - AI Goes Vulnerability Hunting
Every week I’ll provide updates on the latest trends in cloud software companies. Follow along to stay up to date!
SubscribedAI Goes Vulnerability Hunting
This week a couple big security incidents rocked the world. First, a critical vulnerability was found in the core PHP engine (the language that runs 70% of the internet basically!). The vulnerability discovered essentially allows an attacker to take over a web server without logging in. And even worse - this vulnerability had been around for YEARS. In addition to this, LiteLLM (open source library a lot of the ecosystem uses to route model calls) was compromised. A malicious version of LiteLLM was (in the background) harvesting credentials from anyone who used it.
We all know that common libraries and code have vulnerabilities. But they’re just hard for humans to find. AI can scan everything incredibly quickly and spot things humans can’t. These two (PHP and LiteLLM) are just the first of many to come.
PHP is a server side scripting language that’s been around since the mid 90’s. It’s what runs behind the scenes on a web server, taking requests from the browser and sending back the page. PHP runs about 70% of the websites in the world, and it’s what WordPress, Drupal, software behind Wikipedia, etc. For the particular vulnerability discovered, not only can attackers now execute code on the servers, they can also read live memory from the PHP process (meaning passwords, auth tokens, API keys belonging to other people’s requests, etc) are all at risk. The NSA even told organizations to patch things immediately or take their servers offline! One other crazy fact about this vulnerability - a limited version of it was actually discovered back in 2024, but it was written off as “too hard to exploit.” Not anymore… Now, the world discovered a vulnerability living in the engine that runs the internet that has existed for the last 14 years…
So how does a 14 year old vulnerability all of a sudden become “critical”? Earlier this summer the PHP Foundation partnered with OpenAI’s “Patch the Planet” program to audit PHP with OpenAI’s latest security models (they did this with the Calif team). The Calif team probably expected to find nothing (given PHP is arguably one of the most picked over code bases on earth, what hacker hasn’t tried to exploit it!). They then used the latest models, and found the vulnerability! This is maybe getting to much in the weeds, but with the help of Claude:
“The hard part was never spotting the bug. The hard part was chaining several memory bugs together and adapting the exploit to each target’s memory layout - tedious, specialist work that nobody ever bothered to finish. But models don’t get bored.”
The models accomplished in a short amount of time what would have taken humans months (or longer) even if the humans knew what they were supposed to be looking for in the first place! Then, behind the scenes, PHP wrote the fix while OpenAI pulled in industry leaders like Cloudflare, AWS, Google, Microsoft, etc to prep mitigations ahead of disclosing the vulnerability publicly.
Security vulnerabilities generally come in three different types
Known
Unknown
Known but too hard to exploit
The reality is there’s a good amount of the internet that has historically lived “safely” in that third bucket. But not anymore. Bugs that were historically impractical to exploit and now very viable targets (and even worst, they’re known targets you can goal seek a model to break!). In the case of the PHP exploit, maybe we got lucky - a “defender” actor got there before an attacker. OpenAI has also said that they have several more significant vulnerabilities in their queue, and that it expects findings like this to increase in the coming months.
Here’s a practical takeaway for founders. What we know is happening in the background is GOOD actors from OpenAI / Anthropic are working to find these vulnerabilities, and develop patches in the background. As soon as they have the patches ready, they’ll make public announcements about the exploit and the patch, and then it will be on EVERY company to make sure they apply the patch as quickly as possible. So having playbooks / frameworks / tools to implement patches as quickly as possible will become incredibly important.
Final thought - the patch for the PHP vulnerability is for versions later than 8.1. For versions 8.1 or older - there’s no patch currently (I don’t believe). Not good!
Quarterly Reports Summary
Top 10 EV / NTM Revenue Multiples
Top 10 Weekly Share Price Movement
Update on Multiples
SaaS businesses are generally valued on a multiple of their revenue - in most cases the projected revenue for the next 12 months. Revenue multiples are a shorthand valuation framework. Given most software companies are not profitable, or not generating meaningful FCF, it’s the only metric to compare the entire industry against. Even a DCF is riddled with long term assumptions. The promise of SaaS is that growth in the early years leads to profits in the mature years. Multiples shown below are calculated by taking the Enterprise Value (market cap + debt - cash) / NTM revenue.
Overall Stats:
Overall Median: 4.8x
Top 5 Median: 33.1x
10Y: 5.0%
Bucketed by Growth. In the buckets below I consider high growth >22% projected NTM growth, mid growth 15%-22% and low growth <15%. I had to adjusted the cut off for “high growth.” If 22% feels a bit arbitrary, it’s because it is…I just picked a cutoff where there were ~10 companies that fit into the high growth bucket so the sample size was more statistically significant
High Growth Median: 21.0x
Mid Growth Median: 13.8x
Low Growth Median: 7.1x
EV / NTM Rev / NTM Growth
The below chart shows the EV / NTM revenue multiple divided by NTM consensus growth expectations. So a company trading at 20x NTM revenue that is projected to grow 100% would be trading at 0.2x. The goal of this graph is to show how relatively cheap / expensive each stock is relative to its growth expectations.
EV / NTM FCF
The line chart shows the median of all companies with a FCF multiple >0x and <100x. I created this subset to show companies where FCF is a relevant valuation metric.
Companies with negative NTM FCF are not listed on the chart
Scatter Plot of EV / NTM Rev Multiple vs NTM Rev Growth
How correlated is growth to valuation multiple?
Operating Metrics
Median NTM growth rate: 13%
Median LTM growth rate: 16%
Median Gross Margin: 76%
Median Operating Margin 4%
Median FCF Margin: 21%
Median Net Retention: 110%
Median CAC Payback: 31 months
Median S&M % Revenue: 34%
Median R&D % Revenue: 22%
Median G&A % Revenue: 13%
Comps Output
Rule of 40 shows rev growth + FCF margin (both LTM and NTM for growth + margins). FCF calculated as Cash Flow from Operations - Capital Expenditures
GM Adjusted Payback is calculated as: (Previous Q S&M) / (Net New ARR in Q x Gross Margin) x 12. It shows the number of months it takes for a SaaS business to pay back its fully burdened CAC on a gross profit basis. Most public companies don’t report net new ARR, so I’m taking an implied ARR metric (quarterly subscription revenue x 4). Net new ARR is simply the ARR of the current quarter, minus the ARR of the previous quarter. Companies that do not disclose subscription rev have been left out of the analysis and are listed as NA.
Sources used in this post include Bloomberg, Pitchbook and company filings
The information presented in this newsletter is the opinion of the author and does not necessarily reflect the view of any other person or entity, including Altimeter Capital Management, LP (”Altimeter”). The information provided is believed to be from reliable sources but no liability is accepted for any inaccuracies. This is for information purposes and should not be construed as an investment recommendation. Past performance is no guarantee of future performance. Altimeter is an investment adviser registered with the U.S. Securities and Exchange Commission. Registration does not imply a certain level of skill or training. Altimeter and its clients trade in public securities and have made and/or may make investments in or investment decisions relating to the companies referenced herein. The views expressed herein are those of the author and not of Altimeter or its clients, which reserve the right to make investment decisions or engage in trading activity that would be (or could be construed as) consistent and/or inconsistent with the views expressed herein.
This post and the information presented are intended for informational purposes only. The views expressed herein are the author’s alone and do not constitute an offer to sell, or a recommendation to purchase, or a solicitation of an offer to buy, any security, nor a recommendation for any investment product or service. While certain information contained herein has been obtained from sources believed to be reliable, neither the author nor any of his employers or their affiliates have independently verified this information, and its accuracy and completeness cannot be guaranteed. Accordingly, no representation or warranty, express or implied, is made as to, and no reliance should be placed on, the fairness, accuracy, timeliness or completeness of this information. The author and all employers and their affiliated persons assume no liability for this information and no obligation to update the information or analysis contained herein in the future.
© 2026 Jamin Ball
548 Market Street PMB 72296, San Francisco, CA 94104