Security flaws in the PHP programming language, used by a majority of websites globally, highlights the potential of a systemic risk scenario and risk aggregation that has long-worried cyber insurers and resulted in a reluctance to increase their risk appetites aggressively, according to a new AM Best commentary.

The recently discovered vulnerabilities within PHP could allow attackers to gain access to websites and steal sensitive information, as well as create backdoors that can let them access the sites in the future. Government and security agencies urged organizations to make immediate updates or take their systems offline. In its Best’s Commentary, “PHP Vulnerability: A Significant Cyber Event in Times of AI,” AM Best states that it expects the event to have a longer tail as threat actors may wait for some time before they decide to act; the tail could also be lengthened as issues play out in court.

“Cyber insurers and their customers remain concerned about be the use of frontier artificial intelligence models by hackers and cyber criminals seeking to develop exploitation techniques faster than software providers can identify vulnerabilities,” said Anandi Kotecha, director, Industry Research, AM Best.

A significant gap between economic and insured losses is expected in this event, highlighting the importance of cyber insurance. In addition, insured losses may extend beyond cyber into directors and officers insurance as regulatory and governmental bodies in the European Union and the United States have reporting and patching requirements. AM Best expects insurers with embedded and developed enterprise risk management frameworks to update their models, stress tests, and risk management practices to keep up with the latest developments.

“In light of these PHP security flaws, the value provided by cyber insurers in helping clients with forensic analysis, patch management and re-examining cyber defenses should increase demand for cyber insurance,” said Sridhar Manyem, senior director, Industry Research, AM Best.

To access a complimentary copy of this commentary, please visit http://www3.ambest.com/bestweek/purchase.asp?record_code=370043.

AM Best is a global credit rating agency, news publisher and data analytics provider specialising in the insurance industry. Headquartered in the United States, the company does business in over 100 countries with regional offices in London, Amsterdam, Dubai, Hong Kong, Singapore and Mexico City. For more information, visit www.ambest.com.

Copyright © 2026 by A.M. Best Rating Services, Inc. and/or its affiliates. ALL RIGHTS RESERVED.

Media gallery

About The Author
Business Wire