US businesses responding to critical PHP vulnerabilities may face lost revenue before any breach is confirmed, leaving their insurance brokers to establish how cyber policies treat systems taken offline to prevent an attack.
The Cybersecurity and Infrastructure Security Agency has urged organizations to patch the flaws immediately. The National Security Agency has also called for businesses to identify hardware and software services that rely on vulnerable PHP versions and closely monitor vendor updates.
The NSA emphasized maintaining heightened awareness of internet-facing devices and services in the coming weeks, as additional software vendors publish their own patches. That extends the response beyond installing an update to PHP itself.
PHP is a widely used programming language that supports websites and online applications. Developers released emergency fixes on October 21 for two critical vulnerabilities that could allow attackers to execute code remotely without logging in.
Cloudflare subsequently reported millions of exploitation attempts, according to Reuters. CEO Matthew Prince said activity rose from thousands of attempts before the public announcement to hundreds of thousands within two hours afterward.
Read more: NSA warns of critical website flaw as Wikipedia, European government websites taken offline
The response has already disrupted services overseas. Banking and transportation companies in Japan suspended some internet services, illustrating the operational consequences businesses can face while securing vulnerable systems. The immediate insurance issue is how an affected client’s policy responds when management decides to disconnect systems as a protective measure.
Simon Hughes, chief commercial officer at Cowbell, highlighted the cost of those decisions: “Businesses that switch off as a precaution, and the brokers advising them, should check now how their cyber policy treats a voluntary shutdown and what waiting period applies, rather than finding out at claim stage.”
Finland’s state IT provider, Valtori, said its outages were precautionary and that it was unaware of active exploitation of the flaws. Restoring services could take days or weeks because systems needed careful testing alongside updates, Reuters reported.
There is also work involved in identifying which systems are exposed. A client’s public website may be only one part of its reliance on PHP. In an October 21 security alert, Coalition said PHP also supports administrative tools used to manage critical IT infrastructure, including databases and backups. Compromising those interfaces could give attackers access to credentials or control over other systems, the company warned. The broader exposure makes the inventory exercise relevant to discussions between brokers, clients and their technology providers. Confirming a website update alone may leave other PHP-based services requiring attention.
Coalition said exposure spanned current and older PHP versions. Systems running versions that have reached end of life can be harder to remediate, requiring an upgrade to a supported release or confirmation that a vendor has supplied a fix.
Daniel Woods, head of emerging risks at Coalition, addressed how the insurer’s vulnerability alerts relate to coverage.
“Even if AI accelerates vulnerability discovery and exploitation, insurers will continue to work side by side with customers to prevent attacks. Coalition sends vulnerability notifications on a voluntary basis,” Woods said.
Read more: Can cyber insurance survive the Mythos shock?
“We don't have a clause in the policy that bars coverage if they don't apply the patch. In practice, we find customers are very cooperative and that continues with AI-driven attacks.”
Coalition said it had sent an initial alert to some policyholders running known vulnerable PHP versions on October 20. Its threat intelligence team observed exploit-related activity more than five hours before the fix was released.
While Coalition has described one approach, brokers and clients reviewing their provider’s policy still need to establish its terms, alongside the separate question of coverage for a precautionary shutdown.
Meanwhile, Hughes urged businesses to check for signs of compromise, reflecting the possibility that attackers had accessed systems before updates were installed. “AI helped find these flaws, and attackers have access to the same tools. The gap between a fix being published and being exploited is now measured in hours, not weeks," he said. "That’s why continuous monitoring of a business’s exposure matters more than a once-a-year questionnaire."
Woods said: “The increasing speed does, however, necessitate layered defences, such as automatic detection and response to catch any exploitation that can't be patched in time."
