Cyberweapons are software and software, at least intuitively, is nonphysical. Several authors have noted that this potentially renders problematic the application of normative frameworks like UN Charter Article 2(4) to cyberweapons. If Article 2(4) only proscribes the use of physical force, and if cyberweapons are nonphysical, then cyberweapons fall outside the purview of Article 2(4). This article explores the physicality of software, examining Stuxnet in particular. First, I show that with a few relatively uncontroversial metaphysical claims we can secure the (...) conclusion that Stuxnet is physical. In particular, there exist instances of Stuxnet that are both located in space and causally efficacious, and this is very strong evidence for their being physical. Second, I argue that the question of physicality is actually irrelevant for the moral evaluation of an attack like Stuxnet because of its undeniably physical effects. Finally, I argue that some features of Stuxnet should make us optimistic about the prospects for discrimination and proportionality in cyberwarfare. (shrink)