According to ratings agency AM Best, recently discovered security flaws in the PHP programming language used by many websites worldwide have highlighted the potential for the accumulation of cyber risks, which has long worried insurers and made them wary of aggressively increasing their risk appetite.
In three separate comments, AM Best, cyber risk analytics firm CyberCube and Moody’s Ratings highlighted how artificial intelligence accelerates the discovery of such software flaws and increases the potential for systemic cyber risks that could simultaneously affect many policyholders around the world.
Vulnerabilities affecting PHP (formally known as PHP: Hypertext Preprocessor) “could allow attackers to access websites and steal sensitive information, as well as create backdoors that allow them access to the websites in the future,” AM Best said in a press release announces the publication of his comment entitled “PHP vulnerabilities raise concerns about systemic events among cyber insurers.”
CyberCube explained that PHP is the software that runs the code behind about 70% of websites. Two critical flaws in the software “could allow an attacker to take control of a web server or read passwords and other secrets from its memory without having to log in. But the problem goes beyond websites. In many cases, PHP is built into products that customers cannot fix themselves and may not even know it exists.”
After PHP maintainers deployed urgent fixes for two critical bugs – collectively known as PHP2Shell – on October 21, attack attempts skyrocketed within hours and now number in the millions. said CyberCubenoting that no break-ins had been confirmed as of October 23. However, complacency is not an option, said CyberCube.
Insurable losses due to PHP event?
Although governments and security agencies urged organizations to make immediate updates or take their systems offline, AM Best warned that the event “could last for an extended period of time as threat actors may wait some time before deciding to act; the period could also be extended as issues develop in the courts.”
CyberCube predicted that there could be insurable losses from medium and large companies attacked via unupdated PHP servers. “CyberCube believes this is a long-term risk that will diminish as fixes are installed, rather than a single catastrophe.”
“Cyber insurers and their customers remain concerned about the use of breakthrough artificial intelligence models by hackers and cybercriminals seeking to develop exploitation techniques faster than software vendors can identify vulnerabilities,” said Anandi Kotecha, director of industry research at AM Best, in a press release accompanying the report.
These types of programming vulnerabilities are being uncovered by AI models that can now exploit previously discovered vulnerabilities “that are considered too complex for humans to exploit, creating a race between those who want to patch and those who want to exploit,” AM Best said.
“PHP2Shell is one of the clearest signs that AI is making older, overlooked bugs easier to find. Code that remained buggy and untouched for more than a decade has been turned into a working exploit using AI. Most of the exploit code now in public circulation doesn’t work, but the barrier to creating one is quickly falling,” William Altman, director of Cyber Threat Intelligence Services at CyberCube, said in an emailed statement.
CyberCube warned that the lack of confirmed intrusions is not a reason for complacency. “Successful attacks leave almost no trace, so attacks carried out now may not surface as claims until weeks or months later,” the company said.
“Because attackers can now steal passwords or steal hidden access and exploit them later, some claims will not surface until long after the initial attacks, making it more difficult to trace losses to a single event or policy period,” CyberCube added.
Altman warned that insurers should expect more events like this – when a single mistake can affect many policyholders at the same time.
In a Moody’s Ratings commentary, Leroy Terrelonge, senior vice president, cyber credit risk, Digital Economy Group, said the PHP vulnerabilities illustrate how AI can reduce the expertise and effort required to weaponize software vulnerabilities.
“This will add even more pressure on organizations that are already struggling to patch vulnerabilities in a timely manner. While AI can weaponize vulnerabilities in a matter of days, Moody’s rated companies require an average of 87 days to remediate half of the known exploited vulnerabilities in their networks,” Terrelonge added.
“The incident also highlights how growing reliance on third-party platforms can lead to concentrations of cyber risks, allowing vulnerabilities to affect many organizations at the same time,” he said. “In a recent study, we found that the proportion of organizations affected by a cyber incident via a third party more than doubled between 2020 and 2025, from 19% to 39% of organizations rated by Moody’s.”
Gap in insurance coverage
AM Best predicted that this event would create a significant protection gap between economic and insured losses, “underscoring the importance of cyber insurance.” (Economic losses include the price of both insured and uninsured losses).
“The value that cyber insurers provide in helping customers with forensic analysis, patch management and verification of cyber defenses will increase demand for cyber insurance,” the report continued.
Additionally, AM Best noted that covered losses could extend beyond cyberattacks to directors and officers (D&O), as regulatory and government agencies in the EU and US (including the SEC and Department of Defense) have reporting and patching obligations, AM Best continued.
Topics
Cyber carrier
