Following the emergency PHP2Shell fix released in October and the unauthorized access at GMOインターネット, 20 listed security-related stocks expected to remain profitable and post higher revenue have reportedly been carefully selected. In response to the first act, in which stocks were bought indiscriminately, the market is seen moving into a second act in which companies will be selected based on their operating performance.
Late on 21 October, emergency fixes were released for two PHP2Shell vulnerabilities targeting PHP, and CVE-2026-109618 and 109619 raised the level of concern with severity scores of 9.2. PHP is used on approximately 70% of websites whose programming language is known, prompting emergency maintenance at domestic rental-server providers and online game operators. In the same week, unauthorized access to GMOインターネット's Onamae.com Desktop Cloud service for automated FX trading servers was identified, and it was disclosed that approximately 26,739 servers were affected.
The article also describes the response following the discovery of the unauthorized access and the government's response. It states that the Financial Services Agency requested that FX firms strengthen monitoring for suspicious transactions, while security stocks hit their daily price limits on the 22nd before many fell back the following day, the 23rd. Amid the market turmoil, the article conveys the view that the situation in which everything was bought in the first act has ended and that the market is moving into a second act in which stocks will be selected based on operating performance. It explains that 20 companies have been carefully selected that operate in areas such as defense, authentication and monitoring during the period when fixes cannot be applied in time, and that are expected to be profitable and post higher revenue in the current fiscal year.
The selected stocks are arranged with PHP2Shell as the angle for the first half and the GMO incident as the angle for the second half, including companies highlighting their track records, such as applying defense rules before fixes were available. In particular, サイバーセキュリティクラウド provides a cloud-based WAF, and the article highlights its emergency patch application for PHP2Shell and the prospects for ARR growth. It also notes that サイバートラスト launched an emergency measures package using extended support for older PHP versions, suggesting the potential for security-related services to become profitable and post higher revenue.