Follow Beinsure
Discovered vulnerabilities in the PHP programming language have renewed concerns about systemic cyber risk, with AM Best, CyberCube and Moody’s Ratings warning that artificial intelligence could make software weaknesses easier to exploit across thousands of organisations.
The flaws, collectively known as PHP2Shell, affect technology widely used to operate websites and online applications. Their discovery illustrates the potential for a single software vulnerability to expose multiple insured businesses simultaneously, a concentration risk that has historically constrained cyber insurers’ willingness to expand underwriting capacity.
- AM Best warns that PHP2Shell vulnerabilities expose cyber insurers to systemic losses as AI accelerates the discovery and exploitation of software flaws.
- CyberCube reported millions of attack attempts following the October 21 security patches, although no confirmed breaches had been identified as of October 23.
- Moody’s found that third-party cyber incidents among affected rated organisations more than doubled from 19% to 39% between 2020 and 2025, increasing concerns about risk concentration.
In separate assessments, the three organisations examined how AI is accelerating vulnerability discovery, shortening the time available for software providers to respond and increasing the possibility of widespread cyber insurance claims.
AM Best warned that the PHP vulnerabilities “could allow attackers to gain access to websites and steal sensitive information, as well as create backdoors that can let them access the sites in the future.”
The rating agency published its findings in a commentary titled “PHP Vulnerabilities Raises Concerns of Systemic Event for Cyber Insurers.”
PHP2Shell attack attempts surge after emergency security updates
PHP maintainers released urgent patches for two critical vulnerabilities on October 21, 2026. Within hours, attempted attacks increased sharply and subsequently reached millions, according to cyber risk analytics company CyberCube.
As of October 23, no successful intrusions had been confirmed, although CyberCube cautioned that the absence of reported breaches should not be interpreted as evidence that organisations were safe.
Governments and cybersecurity agencies urged businesses to install the updates immediately or consider taking affected systems offline when remediation was not possible.
AM Best warned that the consequences could extend well beyond the initial disclosure and patching period.
The event could have “a longer tail as threat actors may wait for some time before they decide to act; the tail could also be lengthened as issues play out in court,” the rating agency said.
CyberCube expects some insured losses among medium-sized and large enterprises whose unpatched PHP servers are compromised.
The distinction matters for cyber insurers because attacks exploiting the same vulnerability may occur over an extended period rather than producing a concentrated wave of immediately identifiable claims.
AI accelerates vulnerability exploitation and systemic cyber threats
The involvement of advanced artificial intelligence models has added to insurers’ concerns about how quickly attackers can identify and exploit weaknesses in widely deployed software.
AM Best said cyber insurers and their clients remain concerned about hackers using frontier AI models to develop exploitation techniques faster than software providers can identify and address vulnerabilities.
AI models are increasingly capable of exploiting previously discovered vulnerabilities that had been considered too technically complex for human attackers to use effectively. This creates competition between security teams working to patch exposed systems and attackers attempting to exploit them before updates can be deployed.
PHP2Shell provides a clear example of how AI can make longstanding software defects exploitable.
“PHP2Shell is one of the clearest signs yet that AI is making older, overlooked flaws easier to find. Code that sat flawed and untouched for more than a decade was turned into a working exploit with AI’s help. Most of the exploit code now circulating publicly doesn’t work, but the barrier to building one that does is falling fast,” CyberCube said.
Successful exploitation may be difficult to detect immediately, potentially delaying the emergence of related insurance claims. Attackers could steal credentials or establish hidden access to compromised systems before using that access at a later date.
As attackers can steal passwords or plant hidden access now and use it later, some claims will surface long after the first attacks, making it harder to tie losses to a single event or policy period
Insurers to encounter more incidents in which one software flaw creates simultaneous exposure across numerous policyholders.
Moody’s warns of widening gap between AI attacks and patching
Moody’s Ratings identified another concern: the growing difference between the speed of AI-assisted vulnerability exploitation and the time organisations require to implement security fixes.
Moody’s said the PHP vulnerabilities demonstrate how AI can reduce the technical knowledge and effort required to weaponise software weaknesses.
This will put further pressure on organizations that already struggle to patch vulnerabilities in a timely manner. While AI can weaponize vulnerabilities in days, the median Moody’s-rated company takes 87 days to remediate half of known exploited vulnerabilities on its networks.
The findings indicate that organisations may remain exposed for extended periods after vulnerabilities become publicly known, even when security patches are available.
Moody’s also identified growing dependence on third-party technology platforms as a source of concentrated cyber exposure.
The incident also highlights how the growing reliance on third-party platforms can create concentrations of cyber risk, allowing vulnerabilities to affect many organizations simultaneously.
Moody’s research found that among rated organisations experiencing cyber incidents, the proportion affected through a third party increased from 19% in 2020 to 39% in 2025.
That increase illustrates how security weaknesses in widely used external software and services can affect multiple organisations, even when the vulnerability originates outside their own technology infrastructure.
Cyber insurers face long-tail claims and potential protection gaps
The PHP2Shell vulnerabilities raise questions about the potential accumulation of cyber insurance losses when numerous policyholders depend on the same underlying software.
For insurers, delayed discovery of compromises creates additional uncertainty around the timing of claims, the attribution of losses to a particular incident and the policy periods under which coverage may apply.
AM Best expects a significant difference between the overall economic damage associated with the vulnerabilities and the losses ultimately covered by insurance.
The rating agency said this anticipated protection gap also demonstrates the value of cyber insurance beyond financial compensation for an incident.
“The value provided by cyber insurers in helping clients with forensic analysis, patch management, and re-examining cyber defenses will increase demand for cyber insurance,” AM Best said.
Such services may become increasingly relevant as AI reduces the time required to exploit vulnerabilities, while many organisations continue to face lengthy remediation processes.
CyberCube expects the immediate PHP2Shell exposure to diminish as organisations install available patches. Its assessment nevertheless points to the possibility of claims emerging weeks or months after the original discovery, particularly where attackers establish persistent access before vulnerable systems are secured.
