CyberCube expects PHP2Shell claims to arrive slowly, and Crawford warns that patching outages may not be covered

CyberCube has activated its catastrophe response procedures and sent clients a Security Incident Report on PHP2Shell, Insurance Edge reported on 26 October. PHP2Shell is the name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The modeller expects insurable losses from medium-sized and large companies that attackers breach through PHP servers that have not been patched.

CyberCube calls the event a long-tail risk, not a single catastrophe. It expects the risk to shrink as fixes are applied, but says the event could still get worse. Its main concern is timing. Intrusions may become claims only weeks or months later, and attackers may use stolen credentials or hidden access at a later date. Losses could then be hard to tie to one event or one policy period. Attack attempts number in the millions, but most published exploit code does not work and no break-ins have been confirmed. The report warns that successful attacks “leave almost no trace”.

The exposure is wide. According to the report, PHP runs about 70% of websites whose underlying technology can be identified, and CyberCube's single-point-of-failure database links more than 600 technologies to PHP. William Altman, CyberCube's director of cyber threat intelligence services, said insurers should expect more events where “a single flaw” affects many policyholders at the same time. He called PHP2Shell a sign that AI makes older, overlooked flaws easier to find.

Crawford & Company described the claims position to Insurance Business. Robert Holmes, an executive general adjuster at Crawford in Canada, said the key distinction is between precautionary action and a confirmed cyber incident. Policy triggers, waiting periods and security conditions all need careful assessment, and a short outage to patch may not last longer than the waiting period. Recovery may also depend on minimum security standards, the speed of patching and the use of unsupported software. Where a third party hosted or patched the systems, Crawford sees possible liability claims against the provider and subrogation by insurers.

The PHP security team released fixes on 21 October. CyberCube advises clients to stress-test their portfolios against a theoretical catastrophe caused by PHP2Shell.