AM Best, an international credit rating agency specialising in the insurance sector, has warned that security vulnerabilities in the PHP programming language could expose cyber insurers to widespread losses.
In a recent industry commentary, the company examines how the vulnerabilities could contribute to systemic cyber risk, increase the potential for aggregated claims and influence insurers’ willingness to expand their exposure to cyber-related risks.
PHP is used extensively across websites worldwide, and weaknesses in the programming language could provide opportunities for cyber criminals to compromise websites, obtain confidential data and install backdoors to facilitate subsequent access.
Government authorities and cybersecurity agencies have called on organisations to implement the necessary security updates without delay or take affected systems offline where appropriate.
In its Best’s Commentary, PHP Vulnerability: A Significant Cyber Event in Times of AI, AM Best anticipates that the financial and operational consequences could continue to emerge over an extended period. The company notes that attackers may postpone exploiting known vulnerabilities, meaning losses might not become apparent immediately. The handling of related legal disputes could further prolong the development of claims.
Anandi Kotecha, Director of Industry Research at AM Best, commented: “Cyber insurers and their customers remain concerned about be the use of frontier artificial intelligence models by hackers and cyber criminals seeking to develop exploitation techniques faster than software providers can identify vulnerabilities.”
AM Best anticipates a substantial difference between the total economic impact of the incident and the losses covered by insurance policies. The company says this disparity reinforces the role of cyber insurance in helping businesses manage the financial consequences of security incidents.
It also warns that potential claims may affect other insurance lines, including directors’ and officers’ (D&O) cover, if organisations face regulatory scrutiny or legal action relating to compliance with reporting and security patching obligations in the European Union and the United States.
The company further expects insurers with established enterprise risk management frameworks to reassess their risk models, stress-testing procedures and wider controls to reflect the latest developments. AM Best identifies the ability to adapt these processes as an important consideration for insurers managing the potential consequences of widespread software vulnerabilities.
Sridhar Manyem, Senior Director of Industry Research at AM Best, added: “In light of these PHP security flaws, the value provided by cyber insurers in helping clients with forensic analysis, patch management and re-examining cyber defences should increase demand for cyber insurance.”
