The significance of PHP2Shell extends beyond individual website compromises. As noted by cyber risk analysis firm CyberCube, the vulnerability allows attackers to take control of a web server or read passwords and other secrets from its memory without needing to log in. Crucially, the problem is not limited to standalone websites; in many cases, PHP is embedded into products that customers cannot fix themselves and may not even know is present. This embedded nature creates a concentration of risk. Moody’s Ratings senior vice president Leroy Terrelonge explained that this reliance on third-party platforms allows vulnerabilities to affect many organizations simultaneously. A recent Moody’s study indicated that among rated organizations experiencing cyber incidents, the share affected via a third party more than doubled from 19% in 2020 to 39% in 2025.
The driver behind this heightened urgency is the role of artificial intelligence in the cyber threat landscape. According to AM Best, a ratings agency, AI models are now capable of exploiting previously discovered vulnerabilities that were considered too complex for humans to utilize. This has resulted in a “race with those looking to patch versus those looking to exploit.” William Altman, director of Cyber Threat Intelligence Services at CyberCube, stated that PHP2Shell is one of the clearest signs that AI is making older, overlooked flaws easier to find. “Code that sat flawed and untouched for more than a decade was turned into a working exploit with AI’s help,” Altman said. While most of the exploit code currently circulating publicly does not work, the barrier to building a functional exploit is falling rapidly.
For insurers, the immediate concern is not just the volume of attacks, but the difficulty in attributing losses to specific policy periods. CyberCube cautioned that successful attacks leave almost no trace, meaning intrusions made now may only surface as insurance claims weeks or months later. “As attackers can steal passwords or plant hidden access now and use it later, some claims will surface long after the first attacks, making it harder to tie losses to a single event or policy period,” the company noted. This “long-tail” risk contrasts with traditional catastrophe models, where losses are acute and geographically bounded. Here, a single software flaw can trigger a cascade of claims across diverse sectors and geographies, testing the risk appetite of carriers who have historically been reluctant to aggressively increase their exposure to such aggregated risks.
The economic implications of such events are expected to be significant, with a notable gap between total economic losses and insured losses. AM Best predicted that the PHP2Shell event would highlight the importance of cyber insurance, as the value provided by insurers in helping clients with forensic analysis, patch management, and re-examining cyber defenses will likely increase demand for coverage. Furthermore, the exposure may extend beyond standard cyber policies into directors and officers (D&O) insurance. Regulatory bodies in the European Union and the United States, including the SEC and the Department of Defense, have specific requirements for reporting and patching. Failure to meet these deadlines amid a surge in AI-driven attacks could lead to regulatory penalties and legal liabilities that D&O policies are designed to cover.
Organizations are under increasing pressure to respond. Terrelonge from Moody’s pointed out that while AI can weaponize vulnerabilities in days, the median Moody’s-rated company takes 87 days to remediate half of known exploited vulnerabilities on its networks. This disparity highlights a structural weakness in corporate IT security that AI-driven threats are designed to exploit. Governments and security agencies have urged organizations to make immediate updates or take systems offline, but the sheer volume of affected entities—given PHP’s prevalence—makes comprehensive and immediate remediation a logistical challenge for many businesses.
The incident underscores a shifting paradigm in cyber risk. It is no longer just about the sophistication of the attacker, but the speed at which they can find and exploit weaknesses in the global digital supply chain. For the insurance industry, the PHP2Shell event is a test case for how to model and price risks that are ubiquitous, tech-dependent, and accelerated by AI. As the dust settles on the immediate surge of attack attempts, the industry will be watching for the “long tail” of claims that emerge in the coming months, which will provide the first concrete data on the financial impact of this new era of systemic cyber vulnerability.
One Comment