AM Best says in a new report that the PHP vulnerabilities could become a systemic event for cyber insurers, Carrier Management reported on 27 October. The rating agency's view adds to earlier assessments of the flaws, for which fixes became available on 21 October.
The main new point for insurers is that losses may not stay in cyber policies. AM Best says insured losses could also reach directors' and officers' cover, because regulators in the EU and the US, including the SEC and the Department of Defense, have requirements for reporting incidents and applying patches.
The agency also expects a long tail. Attackers who have gained access may wait for some time before they act, so claims could appear over a long period. According to AM Best, attackers could use the flaws to get into websites, steal sensitive data and leave backdoors for later access, and it expects a significant gap between economic and insured losses. It added that AI helps attackers exploit flaws once "considered too complex for humans to utilize", which creates a race between those who patch and those who exploit. AM Best expects that demand for cyber cover may rise.
For scale, the article cites CyberCube, which says PHP runs the code behind about 70% of websites. Attack attempts after the fixes had reached the millions, with no confirmed break-ins as of 23 October.
Read the source
Carrier Management ↗News publisher · 27 Oct 2026
This is an original brief based on the linked publication. Company statements and forecasts are attributed to their source.
