AI-assisted discovery of software flaws is confronting businesses with a “new reality of vulnerabilities,” putting pressure on their ability to identify affected systems and fix weaknesses across their networks, according to Beazley Security’s chief product and technology officer.
The critical PHP2Shell vulnerabilities offer an early illustration of that challenge, said Francisco “Fran” Donoso (pictured). Businesses concentrating on updating their websites can overlook vulnerable software embedded in the devices protecting their networks.
“The acceleration of vulnerability discovery is going to become a challenge for organizations,” Donoso told Insurance Business. “This will not be the last bad vulnerability that we see this month, this year or this quarter. I think that requires that we recalibrate to this new reality of vulnerabilities.”
PHP is a programming language used to run web applications. The PHP project released updates on October 21 addressing two critical vulnerabilities that could allow attackers to execute code remotely without authentication.
Read more: NSA warns of critical website flaw as Wikipedia, European government websites taken offline
Successful exploitation could give attackers access to sensitive information or control over systems. Because the weaknesses sit in PHP itself, updating an application such as WordPress can leave the underlying vulnerability unresolved.
Donoso said businesses also risk overlooking PHP embedded in network security devices while concentrating their remediation efforts on public websites.
“We’re seeing them address a lot of the exposures that they think of, but not the exposures on appliances and systems that are protecting their network as well,” he said.
Updating a website application does not establish whether the PHP software supporting it has been fixed, he warned, or whether other affected systems have been identified.
PHP issued further guidance on October 23, recommending a configuration change for a separate vulnerability involving its session upload progress feature. It said that issue requires an unusual combination of settings and application code and would be addressed through its regular release cycle.
Read more: PHP flaws put US cyber brokers on alert over shutdown coverage
At the time of the interview, Donoso had not heard of fully successful compromises using PHP2Shell. Working exploits existed for specific configurations, he said, but he did not expect a single exploit capable of compromising every system running PHP anytime soon, if at all.
The insurance concern extends beyond whether an individual business has installed a patch. Companies in different industries can depend on the same underlying software, creating a common exposure across otherwise unrelated accounts.
A report by the Financial Stability Institute and International Association of Insurance Supervisors identifies shared software dependencies as a source of accumulation risk. A widely exploited vulnerability could trigger losses across multiple policies, while modeling correlated cyber events remains challenging.
The common dependency makes the location of vulnerable software relevant to both a single client’s response and an insurer’s assessment of how one event could affect its book. Industry diversification alone does not reveal those shared technology exposures.
At the individual account level, the incident also illustrates the limits of a static view of cyber preparedness. A newly disclosed weakness can reveal an exposure in software a business has relied on for years, even when its own security practices have remained unchanged.
Brokers discussing remediation with clients have reason to look beyond confirmation that a website update has been completed. The scope of the response matters, including whether overlooked appliances remain exposed.
Many cyber insurance carriers provide clients with exposure management services to identify internet-facing assets and potential weaknesses. But identifying and patching known flaws is only part of the response.
“At this scale, you need to be able to move rapidly, and the way to move rapidly is to use AI yourself,” said Donoso. “Ultimately, the right answer is working on hardening defense in depth, and thinking about what happens when some vulnerability you don’t know about is actually exploited in your business.”
