[Stock Price Surge] Trend Micro (4704) defies the market with an 8.7% gain! A buying frenzy amid a 1,700-yen Nikkei crash—Why is capital flooding into security stocks due to …

On a day of broad market decline, why was this stock the only one being bought?

The Tokyo stock market on October 22, 2026, was a classic “risk-off” day. The Nikkei Stock Average fell sharply by 1,713 yen from the previous day to 62,907 yen, dropping below the 63,000-yen mark for the first time in about three months. Market leaders like Tokyo Electron, Advantest, and SoftBank Group were sold off across the board, chilling the entire market.

However, amidst that headwind, one stock saw a significant rise: Trend Micro (4704), known for its antivirus software “Virus Buster.” It closed at 7,314 yen, up 585 yen (+8.69%) from the previous day. It ranked among the top gainers on the Tokyo Stock Exchange Prime Market, and its market capitalization recovered to the 1 trillion yen milestone once again.

The trigger was the discovery of an extremely serious flaw in “PHP,” a programming language used by approximately 70% of the world’s websites. This led to an unprecedented situation where banks, cloud providers, and even government agencies both in Japan and abroad preemptively shut down their sites, spreading a sense of urgency that “preparations for cyberattacks cannot wait.”

In this article, we will organize the reasons for this stock price increase from four perspectives: the content of the news, the company’s market position, the stock price movement, and performance-related challenges. To state the conclusion first, this rise is not merely “speculative buying,” but rather a result of the market re-recognizing the structural change where the pace of vulnerability discovery is being dramatically accelerated by AI.

What happened to Trend Micro stock on October 22?

First, let’s review the day’s price movement in chronological order.

The closing price on the previous day, the 21st, was 6,729 yen. On the morning of the 22nd, trading began at 7,006 yen, a jump of about 280 yen. This was because a patch for PHP had been urgently released the previous night, and morning news reports were filled with accounts of domestic services being shut down one after another.

Buying did not stop there, and by 11:00 AM, the stock had risen to 7,260 yen, up 531 yen (+7.89%) from the previous day. The momentum did not fade in the afternoon session, and it ultimately finished the day at 7,314 yen, near its daily high. In after-hours trading (PTS) following the close, it reached an even higher price of 7,350 yen.

What is noteworthy is that this rise occurred on a “day when the index collapsed significantly.” Normally, on a day when the Nikkei Average falls by more than 2%, individual stocks usually fall in sympathy. The fact that Trend Micro showed a rise of over 8% means there was a clear buying catalyst, and it signifies that investor capital turned to security stocks not as a “safe haven,” but as an “active investment destination.”

What kind of company is Trend Micro in the first place?

To understand this news, it is necessary to grasp what kind of company Trend Micro is.

For the general public, the image of the company is strongly associated with “Virus Buster,” the software installed on personal computers. However, the current pillar of its revenue is not for individuals, but for corporations. It deploys security products worldwide that collectively protect corporate servers, cloud environments, networks, and employee PCs, holding the top share in Japan and a high share globally for corporate antivirus software.

Founded in 1988, the company is headquartered in Tokyo, but its research and development bases are dispersed around the world, including Taiwan, and it is a global enterprise that earns the majority of its sales overseas. Among Japanese listed companies, it can be said to be one of the few “cybersecurity-specialized manufacturers capable of competing on the world stage.”

Another known strength of the company is the depth of its vulnerability research. The company operates the “Zero Day Initiative,” one of the world’s largest vulnerability disclosure programs, putting it in a position where information on software flaws is easily gathered. Furthermore, it has provided products with a mechanism called “virtual patching,” which blocks attack traffic at the network level even before a patch is applied to the server. A situation like this, where “the fix is not ready, but the attack has already begun,” is exactly the scenario where the company’s products demonstrate their true value.

What was the critical “PHP” flaw that triggered this?

So, what was the “PHP vulnerability” that moved the stock price?

PHP is a programming language that runs behind the scenes of websites. When we search for products on an online shop or log in to a membership site, it is a language like PHP that executes those processes on the server. According to web technology survey services, approximately 69% of sites where the server-side language can be identified use PHP. “WordPress,” which serves as the foundation for corporate sites and blogs around the world, is also written in PHP.

The two flaws discovered this time were at an “emergency” level, with a severity score of 9.2 out of 10. The core of the problem is that an outsider who has not even logged in could potentially run arbitrary programs on the server simply by sending crafted data. From a hijacked server, customer information and payment data could be stolen, and there is also a risk of site tampering or the server being used as a stepping stone to attack other organizations.

Moreover, the scope of the impact extended to versions from over 10 years ago. To use a house analogy, it was not that the key to a specific house was broken, but that a flaw was found in the building materials used for houses all over town. The scale of the damage is on a different order of magnitude than a bug in an individual piece of software.

What made the situation even worse was the leak of information. The PHP development team originally planned to announce the flaw at the same time as the release of the patched version, but the existence of the flaw leaked on social media before the announcement. As a result, they had to move up the release of the patch, leading to an emergency release around 11:00 PM Japan time on October 21. Because the risk of attackers moving first became a reality, site operators around the world braced themselves all at once.

Unprecedented situation: sites shut down worldwide, even the Prime Minister took action

The reason this incident did not end as “just technical news” is that its impact reached social infrastructure.

In Japan, Shizuoka Bank temporarily suspended its internet banking, Sakura Internet stopped some functions of its cloud service, and Xserver temporarily suspended its official site and management screens. Familiar services such as BASE, Chatwork, pixiv, Cygames games, and Kodomon for childcare facilities also entered emergency maintenance one after another. Some municipal sites, such as those in Sendai City, were also suspended. According to reports, the impact spread to over 20 companies and organizations in Japan alone.

The situation overseas was even more extensive. The Netherlands preemptively shut down its administrative portal and national electronic authentication infrastructure, and the country’s cybersecurity authority even shut down its own site. Finland completely stopped its government public internet services, and government sites were temporarily suspended one after another in France, Canada, Australia, Germany, and elsewhere. The U.S. National Security Agency (NSA) recommended taking systems offline if they could not be patched immediately, and the White House also issued a statement.

In Japan, Prime Minister Takaichi personally called on companies via X to apply the patches, stating that it was important to temporarily suspend sites if necessary. It is extremely rare for a Prime Minister to issue a direct message regarding a flaw in a single programming language.

What is important here is that many organizations did not “stop because they were attacked,” but “stopped on their own before being attacked.” This means that the frontline judged that the loss from stopping would be far less than the loss if they were hijacked. In fact, U.S.-based Cloudflare has revealed that it is already observing a large amount of traffic attempting to exploit this flaw.

Found by AI: The structural change called “Bugmageddon”

What sets this event apart from “common vulnerability scares” is the history of its discovery. It was not human researchers who found this flaw, but AI.

The latest models from U.S.-based OpenAI and Wiz, a security company under the Google umbrella, noticed the problem during verification using cutting-edge AI and reported it to the PHP governing body in August. This means that AI unearthed a flaw that had slipped past the eyes of developers around the world for over 10 years.

This is not an isolated event. The term “Bugmageddon” is beginning to be used in the industry. It is a coined term expressing the concern that due to the improvement in AI capabilities, software flaws that have been overlooked until now will be discovered one after another, and the materials for attacks will increase explosively. In fact, the number of serious vulnerabilities announced by major software companies has surged since the spring of 2026, and it is reported that in September, it reached about eight times the level of March.

AI can also be a weapon for the defense side, but the same capability will eventually fall into the hands of the attack side. If the attack and defense sides are equal in the “speed of finding” vulnerabilities, what determines the outcome is “how quickly the discovered flaws can be closed.” This composition can be a medium- to long-term tailwind for security companies that have products to buy time until patches are finished or services that use AI for monitoring and detection.

In fact, on the same day, the 22nd, it was reported that member information for up to approximately 4.2 million accounts might have been leaked from an e-book service, and a vulnerability with the highest level of severity was also announced for the software development platform “GitLab.” The PHP incident can be said to be the “biggest blow” in this chain of cyber incidents.

Why was Trend Micro stock bought? 3 reasons

So, why did the market direct so much capital to Trend Micro? The reasons can be organized into three main points.

The first is the expectation of short-term demand expansion. Are we using PHP? Is an old version left in the company? Have we already been infiltrated? With this incident, many companies were forced to conduct a total inspection of their systems. In particular, systems running on old, unsupported PHP cannot receive official patches, placing them in a situation where they “cannot be fixed immediately but must be protected.” In such situations, speculation spread that inquiries for virtual patches that block attacks at the network level and detection services that search for traces of intrusion would strengthen.

The second is its clarity as a “representative Japanese security stock.” There are many cybersecurity-related stocks in Japan, but there are limited stocks with a market capitalization of 1 trillion yen where institutional investors can easily invest significant capital. When capital moves based on a theme, the first stocks to be bought are the “representative stocks of that theme.” This time, Trend Micro played exactly that role.

The third is its relationship with AI. The company reported a partnership with U.S.-based generative AI giant Anthropic in April of this year, which caused its stock price to soar. The content was about strengthening measures against threats like ransomware using AI. In an era where “AI finds vulnerabilities,” the positioning as a company that can utilize AI on the defense side is highly compatible with this news. It can be said that the market invested capital not just because “security demand will increase,” but also in the narrative of being a “standard-bearer for security in the AI era.”

Stock price movement: A counter-trend rise amidst a broad decline, and the year-to-date high is in sight

Here, let’s look back at the stock price trend over a slightly longer time axis.

Trend Micro stock hit a low of 4,789 yen in late February 2026. After that, it soared on the news of the Anthropic partnership in April, and although it struggled through the summer due to a downward revision in performance, it strengthened its upward trend again from early autumn. On October 13, it hit a year-to-date high of 7,667 yen.

Furthermore, on October 16, it was reported that Iwai Cosmo Securities had raised its investment rating, and the expansion of security demand due to the rapid increase in unauthorized access was evaluated. The stock rose to 7,346 yen that day, up 276 yen from the previous day. However, the following week, it fell back due to the instability of the overall market, such as the adjustment of AI-related stocks, and was pushed back to 6,729 yen on the 21st.

In other words, this 585-yen rise was a case of “a powerful catalyst flying in while the upward trend was taking a breather.” It became a perfect buying opportunity for investors who had been waiting for a dip, and it almost wiped out the recent decline in a single day. It is at a level about 50% higher than the February low.

The next milestone is the year-to-date high of 7,667 yen set on October 13. Whether it can break through this is the short-term focus. Further above, the 52-week high of 8,217 yen set last October is waiting. On the other hand, the margin buying ratio exceeds 10 times, meaning there are many investors buying on margin. After a sharp rise, profit-taking sales and the unwinding of margin buying are likely to occur, so caution is required regarding the possibility of volatile price movements.

Other security stocks also rose across the board: The spread of a “theme market”

It was not just Trend Micro that was bought on the 22nd. Cybersecurity-related stocks were widely sought after.

HENNGE (4475), which became the top gainer on the TSE Prime Market, rose 14.5%. The company provides secure login for cloud services, and a specific factor of transitioning to the Prime Market also overlapped. In the Growth Market, FFRI Security (3692) rose significantly by 9.6%, and Cyber Security Cloud, GMO GlobalSign Holdings, Segue Group, Soliton Systems, SecureVeil, and Digital Arts were also bought.

In this way, even on a day when the index collapses significantly, if there is a clear “theme,” capital concentrates on specific sectors. This time, it is thought that there was also an aspect of capital moving from semiconductor and AI infrastructure-related stocks, which pushed down the Nikkei Average, to security-related stocks. However, since small-cap security stocks have light price movements, they also fall back quickly once the catalyst has run its course. In a theme market, an attitude of calmly discerning which stocks will lead to actual orders and performance is indispensable.

However, one cannot be happy without reservation: Performance-related challenges

While this may seem like nothing but good news, Trend Micro faces challenges that cannot be overlooked. The primary issue is a decline in profit margins.

On August 13, the company revised its full-year earnings forecast for the fiscal year ending December 2026 downward. While it expects record-high revenue of 301.5 billion yen, a 9.2% increase year-on-year, it significantly lowered its operating profit forecast from the initial 564 billion yen to 444 billion yen, a 23.2% decrease. Net profit is also expected to fall by 11.1% to 307 billion yen. Although revenue for the first half was strong, up 11% year-on-year, operating profit saw a decline of over 20%.

The main drivers of this profit decline are increased cloud-related costs associated with AI usage (so-called “AI token costs”) and rising personnel expenses. The more AI is integrated into products, the higher the computational processing costs become. Additionally, the burden of rising overseas labor costs due to the weak yen and the fierce competition for AI talent are weighing heavily on the company.

This brings us to the “other side” of this news. While an era where AI uncovers massive numbers of vulnerabilities pushes up demand for security, it also increases the computational costs and R&D expenses required to address them. Even if revenue grows, if costs expand faster, profits will not increase. Looking at stock valuation metrics, the P/E ratio is around 31x and the P/B ratio is around 8x, levels that already heavily factor in expectations for growth. Future stock performance will be tested not just by whether demand increases, but by whether that demand can be converted into profit.

Points to Watch Moving Forward

So, where should investors focus their attention from here? There are three key points.

First is the third-quarter earnings report scheduled for mid-November. The focus will be on how much the increase in AI-related costs was contained by the July-September period and whether the full-year forecast can be maintained. Since the PHP incident occurred in October, the impact of that demand on the numbers will not appear until the October-December quarter at the earliest, but management’s commentary on order trends and inquiries will likely significantly influence the stock price.

Second is the “long tail” of the PHP issue. Many sites still run on old, unsupported versions of PHP, and reports of damage and attacks may continue. If large-scale data breaches actually occur, the necessity of security investment will be felt even more strongly. Conversely, if the commotion dies down quickly, the fervor for theme-based buying is likely to cool.

Third is the competitive environment surrounding AI. In this instance, it was internet infrastructure companies like Cloudflare that showed their presence by blocking attack traffic, while it was companies affiliated with OpenAI and Google that discovered the flaws. As giant tech companies enter the security space in earnest, what unique value can Trend Micro demonstrate? The concrete results of its partnership with Anthropic will be the key to determining its future valuation.

Summary

The rise in Trend Micro’s stock on October 22 was triggered by the discovery of a critical flaw in “PHP,” used by about 70% of the world’s websites, which could allow servers to be hijacked without requiring a login. In an extraordinary situation where banks and government agencies both domestically and abroad shut down their sites and the Prime Minister personally called for a response, funds concentrated in this representative Japanese cybersecurity stock. The fact that it bucked the trend with an 8.7% gain and recovered a market capitalization of 1 trillion yen on a day when the Nikkei 225 fell by over 1,700 points shows how seriously the market took this issue.

Behind this lies a structural change: the arrival of a “bugmageddon” era where AI unearths one flaw after another that humans could not find. The expansion of security demand is no longer a temporary boom but is becoming a long-term trend.

On the other hand, Trend Micro expects a significant decline in operating profit for this fiscal year due to ballooning AI-related costs, and its stock price already reflects high expectations. Can it turn the tailwind of demand into actual profit growth? The November earnings report will be the first litmus test to determine the answer.

A day when “defensive IT” turned into an “offensive investment theme.” This price movement reminded us once again how important cybersecurity has become for both our daily lives and the stock market.