London – 23 October, 2026 – CyberCube, the leading provider of cyber risk analytics for the insurance industry, views PHP2Shell as a significant security issue, and a watershed moment for furthering understanding of how AI-driven discovery of software flaws could play out.
William Altman, Director of Cyber Threat Intelligence Services, CyberCube, said: “PHP2Shell is one of the clearest signs yet that AI is making older, overlooked flaws easier to find. Code that sat flawed and untouched for more than a decade was turned into a working exploit with AI’s help. Most of the exploit code now circulating publicly doesn’t work, but the barrier to building one that does is falling fast.
“Insurers should expect more events like this: a single flaw affecting many policyholders at once, attack attempts within hours of disclosure, and a long tail of systems that won’t or can’t be patched. That makes patching speed a stronger underwriting signal, and makes stress-testing portfolios against scenarios that haven’t happened yet more important.”
Following the disclosure of the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, CyberCube's Cyber Aggregation Event Response Service (CAERS) initial procedures were activated. CAERS provides up-to-date intelligence on major cyber catastrophes worldwide as they unfold to ensure CyberCube clients have the most relevant information regarding significant aggregation events. CyberCube has created a Security Incident Report (SIR) for clients and will issue follow-on guidance as appropriate.
According to the SIR, PHP is the software that runs the code behind roughly 70% of websites whose underlying technology can be identified. Two critical flaws within it, known together as PHP2Shell, can allow an attacker to take control of a web server, or read passwords and other secrets from its memory, without the need to log in. However, the problem extends beyond websites. In many cases, PHP is built into products that customers cannot fix themselves and may not even know it is there.
PHP’s security team announced an emergency security release for 21 October. A first probe was spotted four days before the fix, and attempts have since grown into the millions, but very little of the published attack code works, and no break-ins have been confirmed.
The SIR states: “The absence of confirmed break-ins is no reason for complacency: successful attacks leave almost no trace, so intrusions made now may only show up as claims weeks or months later. As attackers can steal passwords or plant hidden access now and use it later, some claims will surface long after the first attacks, making it harder to tie losses to a single event or policy period.”
It adds that some insurable loss is expected to come from medium and large enterprises breached through PHP servers that have not been updated. In CyberCube's opinion, this is a long-tail risk that will shrink as fixes are installed, rather than a single catastrophe. The situation also has the potential to worsen, and clients are encouraged to test their portfolios using CyberCube’s Portfolio Manager product to see the potential range of outcomes that could occur from a potential but still theoretical PHP2Shell-enabled cyber catastrophe.
A single point of failure (SPoF) is a technology or provider many companies depend on at once. Searching its SPoF database, CyberCube found over 600 technologies tied to PHP.
Media contact: Yvette Essen, Head of Communications & Market Engagement, yvettee@cybcube.com