The insurance industry is closely monitoring PHP2Shell amid concerns of a systemic event that could overwhelm the sector with billions in cybersecurity risk claims.
PHP Foundation and multiple government authorities last week warned about two critical vulnerabilities in the scripting language used in more than 70% of websites. If successfully exploited, those vulnerabilities could enable an attacker to achieve remote code execution.
The insurance sector has long feared that a systemic cybersecurity event could lead to billions of dollars in claims that extend well beyond any existing risk models.
“The PHP vulnerability is a scenario of systemic risk that has long worried cyber insurers and resulted in a reluctance to increase their risk models aggressively,” researchers from AM Best said in a report released Tuesday.
CyberCube, a firm that specializes in risk analytics, said PHP2Shell is a “watershed moment” in terms of understanding how AI-driven discovery of software flaws could play out over time.
The flaws include a memory corruption vulnerability, tracked as CVE-2026-109618 and a state internal request-state vulnerability, tracked as CVE-2026-109619.
As previously reported, malicious actors are increasingly using AI to exploit critical vulnerabilities, which means security teams might have only days and hours before an unpatched system could be compromised.
The actual impact has been very limited thus far, according to researchers. Numerous government agencies, private companies and critical infrastructure providers disconnected their sites following warnings about the vulnerability.
The Cybersecurity and Infrastructure Security Agency on Monday added the flaws to its Known Exploited Vulnerabilities catalog and also urged users to upgrade their software to supported versions.
AM Best warns that financial risk could extend well beyond just a cyber insurance event, resulting in liability that would impact board directors and corporate officers. Cyber insurers provide errors and omissions coverage in situations where companies are held liable for failure to take steps to mitigate potential risk or properly warn investors.
