Precautionary shutdowns, not confirmed breaches, are driving early PHP2Shell losses, Marsh Re said in a new report, putting cyber policy triggers in focus for brokers.
In an October report, the reinsurance broker examined two critical flaws in PHP, a scripting language it estimates runs 77% of websites. Emergency patches arrived October 21.
Marsh Re expects business interruption to be the main loss driver, rated medium to high, especially for online retailers that rely on web access. Recoverability depends on policy wording, trigger, waiting periods, sublimits and the treatment of precautionary shutdowns, the report said.
Dutch government services, Finland’s state IT center and a Danish municipal IT provider supporting schools temporarily restricted access or went offline, the report noted. Most services were restored after remediation.
Marsh Re said that when it wrote the report, no widespread successful breaches had been confirmed. Since then, evidence of exploitation has grown.
The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog on Monday. Federal agencies must patch by October 29, but the agency has not said which organizations were compromised.
Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots last week. He warned the single-worker setup may not reflect how reliably the exploit works on production servers.
Cybersecurity firm Dream said it found artifacts of a China-nexus campaign that chained PHP2Shell with a Linux kernel flaw and rooted 25 servers in four countries. Palo Alto Networks said Thursday it had observed active exploitation of internet-exposed management interfaces. Researcher Kevin Beaumont has said he is aware of a ransomware group using PHP2Shell against Palo Alto firewalls. Marsh Re had not confirmed ransomware activity when it published.
Cowbell’s Simon Hughes said businesses that switch off as a precaution, and their brokers, “should check now how their cyber policy treats a voluntary shutdown and what waiting period applies, rather than finding out at claim stage.”
Coalition said its policy has no clause barring coverage if clients skip the patch. Brokers still need to confirm other carriers’ terms.
Beazley Security’s Francisco Donoso said firms focused on websites may overlook PHP embedded in appliances that protect their networks. “This will not be the last bad vulnerability that we see this month, this year or this quarter,” he told Insurance Business.
Marsh Re noted that insured portfolios skew toward better-resourced firms with faster patching cycles, which should moderate losses. It warned that small and mid-sized firms may face longer remediation tails, so losses could migrate toward those segments over time.
Marsh Re places PHP2Shell between acute catastrophe and routine patching, closer to the latter for now, but with a credible path to the former.
AM Best researchers said in a report: “The PHP vulnerability is a scenario of systemic risk that has long worried cyber insurers and resulted in a reluctance to increase their risk models aggressively.”
“We’ve never seen a true 1-in-200-year cyber catastrophe, but in theory the market is well capitalized for one,” said William Altman, CyberCube’s director of threat intelligence services. “That’s not what we’re facing today with PHP2Shell.”
