The insurance industry is watching PHP2Shell closely, amid concern that a systemic event could produce billions of dollars in cybersecurity claims beyond current risk models, according to Cybersecurity Dive.
The PHP Foundation and multiple government authorities warned last week about two critical vulnerabilities in PHP, a scripting language used on more than 70% of websites. If exploited, the flaws could let an attacker achieve remote code execution. The flaws are tracked as CVE-2026-109618, a memory corruption vulnerability, and CVE-2026-109619, a state internal request-state vulnerability.
AM Best researchers said in a report released Tuesday that the PHP vulnerability is a systemic risk scenario that has long worried cyber insurers and has led them to be reluctant to aggressively expand their risk models. Sridhar Manyem, senior director of industry research at AM Best, said concerns about a systemic event have limited market supply. He added that a high-profile exploitation event could also increase demand for protection against AI-enabled threats.
CyberCube, a risk analytics firm, called PHP2Shell a "watershed moment" for understanding how AI-driven discovery of software flaws could play out over time. C