PHP vulnerability raises fears of systemic cyber claims

Critical vulnerabilities in PHP could expose businesses to systemic cyber claims, with insurers warning that the speed of exploitation and difficulty identifying affected systems could complicate risk management.

The National Cyber Security Centre (NCSC) has urged organisations to identify systems running PHP and apply security updates after two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed.

The vulnerabilities could allow unauthenticated attackers to execute commands on web servers or access sensitive information. The NCSC has advised organisations unable to patch or applying temporary mitigations to consider taking affected systems offline.

According to the SIR, PHP runs behind roughly 70% of websites whose underlying technology can be identified. CyberCube said attack attempts had grown into the millions, although it had not confirmed any successful breaches.

William Altman, director of cyber threat intelligence services at CyberCube, said: “PHP2Shell is one of the clearest signs yet that artificial intelligence (AI) is making older, overlooked flaws easier to find.”

He added that code which had remained flawed for more than a decade had been turned into a “working exploit” with AI’s help, warning that the barrier to developing effective attacks was falling.

“Insurers should expect more events like this. A single flaw affecting many policyholders at once, attack attempts within hours of disclosure and a long tail of systems that won’t or can’t be patched,” Altman said.

Policy implications

The vulnerability also raises questions about the financial consequences for businesses that take systems offline as a precaution.

Simon Hughes, chief commercial officer at Cowbell, said many small businesses might not know whether their websites or customer portals relied on PHP, urging them to contact their hosting providers to establish their exposure and confirm whether updates had been applied.

He added that businesses and brokers should check how cyber policies treat voluntary shutdowns and applicable waiting periods, rather than discovering restrictions when making a claim.

Graham Ludlam, partner for speciality and complex risk insurance at HF, said identifying and patching vulnerabilities was generally considered day-to-day IT expenditure and would not typically be covered by London market cyber policies.

“Most London market cyber policies will only respond once a relevant event, such as a breach or cyber incident, has occurred,” he said.

Ludlam warned that successful exploitation across multiple organisations could create a “substantial accumulation of cyber claims”, while failure to address a known vulnerability could also create management liability exposures if it amounted to a breach of directors’ duties.

Meanwhile, Alessandro Lezzi, group head of cyber risks at Beazley, said its exposure management capabilities had identified more than 300 software products using PHP, enabling it to alert potentially affected clients.

“The PHP vulnerabilities are a reminder that organisations can’t fix what they can’t see,” he said.