PHP Flaws Highlight AI’s Systemic Risk for Cyber Insurers

By Amara Osei

Attack attempts against two critical PHP flaws known as PHP2Shell surged into the millions within hours of urgent fixes released on Oct. 21, CyberCube said. As of Oct. 23, no break-ins had been confirmed, according to the cyber risk analysis firm.

PHP, formally known as PHP: Hypertext Preprocessor, is used by many websites globally, ratings agency AM Best said. Its commentary, “PHP Vulnerabilities Raises Concerns of Systemic Event for Cyber Insurers,” frames the episode as a potential concentration of cyber risk.

In a press release announcing its commentary, AM Best said the flaws “could allow attackers to gain access to websites and steal sensitive information, as well as create backdoors that can let them access the sites in the future.” The agency said the PHP vulnerabilities have renewed concern about risk aggregation, a long-standing issue for insurers.

AM Best said risk aggregation has made insurers reluctant to aggressively increase risk appetites. In three separate commentaries, AM Best, CyberCube and Moody’s Ratings warned that AI accelerates flaw discovery and raises the potential for systemic cyber risks that could hit many policyholders across the globe.

What makes PHP2Shell a systemic risk?

PHP’s maintainers issued the urgent Oct. 21 fixes for two critical flaws known together as PHP2Shell, CyberCube said. AM Best said such vulnerabilities can expose many policyholders simultaneously, turning a single programming defect into potential systemic cyber risk.

Governments and security agencies urged organizations to update immediately or take their systems offline, AM Best said. CyberCube predicted some insurable losses at medium and large enterprises breached through PHP servers that remain unupdated.

When could claims emerge?

AM Best warned the event could have “a longer tail as threat actors may wait for some time before they decide to act; the tail could also be lengthened as issues play out in court.”

CyberCube expects a delayed pattern: “In CyberCube’s opinion, this is a long-tail risk that will shrink as fixes are installed, rather than a single catastrophe.”

CyberCube cautioned that the lack of confirmed break-ins did not remove the risk. “Successful attacks leave almost no trace, so intrusions made now may only show up as claims weeks or months later,” the company said.

CyberCube added: “As attackers can steal passwords or plant hidden access now and use it later, some claims will surface long after the first attacks, making it harder to tie losses to a single event or policy period.” William Altman, director of Cyber Threat Intelligence Services at CyberCube, warned insurers to expect more events in which a single flaw affects many policyholders simultaneously.

How is AI changing the risk?

Anandi Kotecha, director of Industry Research at AM Best, said: “Cyber insurers and their customers remain concerned about the use of frontier artificial intelligence models by hackers and cyber criminals seeking to develop exploitation techniques faster than software providers can identify vulnerabilities.”

AM Best said AI models can now exploit previously discovered vulnerabilities “considered too complex for humans to utilize.” The agency framed the result as a race between those patching software and those exploiting it.

CyberCube’s William Altman said in an emailed statement: “PHP2Shell is one of the clearest signs yet that AI is making older, overlooked flaws easier to find. Code that sat flawed and untouched for more than a decade was turned into a working exploit with AI’s help.”

Altman added: “Most of the exploit code now circulating publicly doesn’t work, but the barrier to building one that does is falling fast.” He said the narrowing barrier could make older, overlooked flaws actionable more quickly.

What do Moody’s Ratings’ data show?

Leroy Terrelonge, senior vice president, Cyber Credit Risk, Digital Economy Group at Moody’s Ratings, said the PHP flaws show how AI can lower the expertise and effort needed to weaponize software vulnerabilities. He said AI can compress the time required to turn a flaw into an exploit.

Terrelonge said: “This will put further pressure on organizations that already struggle to patch vulnerabilities in a timely manner. While AI can weaponize vulnerabilities in days, the median Moody’s-rated company takes 87 days to remediate half of known exploited vulnerabilities on its networks.”

Terrelonge said: “The incident also highlights how the growing reliance on third-party platforms can create concentrations of cyber risk, allowing vulnerabilities to affect many organizations simultaneously.” He called the PHP case a clear example of concentration risk.

Terrelonge’s study quantified the shift: “In a recent study, we found that out of Moody’s-rated organizations that experienced a cyber incident, the share of organizations affected by a cyber incident via a third party more than doubled from 19% to 39% between 2020 and 2025.”

What is the insurance protection gap?

AM Best predicted the PHP event would produce a significant protection gap between economic and insured losses, “highlighting the importance of cyber insurance.” The agency defined economic losses as the combined price tag for insured and uninsured losses.

AM Best linked broader insurer services to demand. “The value provided by cyber insurers in helping clients with forensic analysis, patch management, and re-examining cyber defenses will increase demand for cyber insurance,” the report said.

AM Best also said insured losses may extend beyond cyber into directors and officers (D&O) insurance. It linked that risk to reporting and patching requirements from EU and U.S. regulatory and governmental bodies, including the SEC and the Department of Defense.

The next test for cyber insurers is whether unpatched PHP servers generate claims weeks or months after Oct. 21. AM Best predicts a significant protection gap, while Altman expects more events in which one flaw affects many policyholders simultaneously.