PHP Security Flaws Highlight Potential Systemic Risk Aggregation for Cyber Insurers

Recently discovered security flaws in PHP programming language, used by many websites globally, has highlighted the potential for cyber risk aggregation, which has long worried insurers and made them reluctant to aggressively increase their risk appetites, according to the ratings agency AM Best. In three separate commentaries, AM Best, cyber risk analysis firm CyberCube and Moody’s Ratings all highlighted how artificial intelligence is accelerating the discovery of such software flaws and increasing the potential for systemic cyber risks which could simultaneously hit many policyholders across the globe. Vulnerabilities affecting PHP (formally known as PHP: Hypertext Preprocessor) “could allow attackers to gain access to websites and steal sensitive information, as well as create backdoors that can let them access the sites in the future,” AM Best said in a press release announcing the publication of its commentary titled “PHP Vulnerabilities Raises Concerns of Systemic Event for Cyber Insurers.” CyberCube explained that PHP is the software that runs the code behind roughly 70% of websites. Two critical flaws in the software “can allow an attacker to take control of a web server, or read passwords and other secrets from its memory, without the need to log in. However, the problem extends beyond websites. In many cases, PHP is built into products that customers cannot fix themselves and may not even know it is there.” After PHP’s maintainers on Oct. 21 provided urgent fixes for two critial flaws — known together as PHP2Shell — attack attempts surged within hours and have now run into the millions, said CyberCube, noting that as of Oct. 23 no break-ins had been confirmed. However, complacency is not an option, CyberCube said. Insurable Losses From PHP Event? Although governments and security agencies urged organizations to make immediate updates or take their systems offline, AM Best warned the event could have “a longer tail as threat actors may wait for some time before they decide to act; the tail could also be lengthened as issues play out in court.” CyberCube predicted there could be some insurable losses from medium and large enterprises breached through PHP servers that have not been updated. “In CyberCube’s opinion, this is a long-tail risk that will shrink as fixes are installed, rather than a single catastrophe.” “Cyber insurers and their customers remain concerned about be the use of frontier artificial intelligence models by hackers and cyber criminals seeking to develop exploitation techniques faster than software providers can identify vulnerabilities,” said Anandi Kotecha, director, Industry Research, AM Best, in a press statement accompanying the report. These types of programming vulnerabilities are being exposed by AI models that can now exploit previously discovered vulnerabilities “considered too complex for humans to utilize, resulting in a race with those looking to patch versus those looking to exploit,” AM Best said. “PHP2Shell is one of the clearest signs yet that AI is making older, overlooked flaws easier to find. Code that sat flawed and untouched for more than a decade was turned into a working exploit with AI’s help. Most of the exploit code now circulating publicly doesn’t work, but the barrier to building one that does is falling fast,” according to William Altman, director of Cyber Threat Intelligence Services, at CyberCube, in an emailed statement. CyberCube cautioned that the absence of confirmed break-ins is no reason for complacency. “Successful attacks leave almost no trace, so intrusions made now may only show up as claims weeks or months later,” the company said. “As attackers can steal passwords or plant hidden access now and use it later, some claims will surface long after the first attacks, making it harder to tie losses to a single event or policy period,” CyberCube added. Altman warned that insurers should expect more events like this – when a single flaw could affect many policyholders at once. In a commentary from Moody’s Ratings, Leroy Terrelonge, senior vice president, Cyber Credit Risk, Digital Economy Group, said the PHP security flaws illustrate how AI can reduce the expertise and effort needed to weaponize software vulnerabilities. “This will put further pressure on organizations that already struggle to patch vulnerabilities in a timely manner. While AI can weaponize vulnerabilities in days, the median Moody’s-rated company takes 87 days to remediate half of known exploited vulnerabilities on its networks,” Terrelonge added. “The incident also highlights how the growing reliance on third-party platforms can create concentrations of cyber risk, allowing vulnerabilities to affect many organizations simultaneously,” he said. “In a recent study, we found that out of Moody’s-rated organizations that experienced a cyber incident, the share of organizations affected by a cyber incident via a third party more than doubled from 19% to 39% between 2020 and 2025.” Insurance Protection Gap AM Best predicted this event would see a significant protection gap between economic and insured losses, “highlighting the importance of cyber insurance.” (Economic losses include the price tag for both insured and uninsured losses). “The value provided by cyber insurers in helping clients with forensic analysis, patch management, and re-examining cyber defenses will increase demand for cyber insurance,” the report continued. In addition, AM Best noted that insured losses may extend beyond cyber into directors and officers (D&O) because regulatory and governmental bodies in the EU and the US (including the SEC and the Department of Defense) have requirements for reporting and patching, AM Best continued. Topics Cyber Carriers