When AI uncovers a decade-old vulnerability: The PHP2Shell wake-up call

What is the PHP2Shell vulnerability and which systems are at risk?

Two critical weaknesses, known together as PHP2Shell, have been identified in PHP, technology widely used to support websites, online applications and commercial and open-source products. That means your business could be exposed even if you don’t knowingly use PHP.

Fixed versions of PHP were released on 21 October 2026, but if you’re running PHP 8.1 or earlier, you may need to check whether your provider offers a fix and consider additional action where one isn’t available.

How could AI-discovered vulnerabilities like PHP2Shell increase cyber risk?

According to Wiz Research, advanced AI tools helped researchers identify and demonstrate weaknesses hidden in PHP for more than a decade.

AI didn’t create these weaknesses, it helped researchers complete highly complex work more quickly. Wiz reports one AI-assisted researcher completed work that may have previously taken a skilled team several months in one week.

For risk and insurance managers, the PHP incident shows how AI can shorten the time between the discovery of a weakness and attack, potentially increasing your cyber exposures.

What immediate actions should businesses take to address PHP2Shell?

Applying the appropriate update is the immediate priority. However, while the update closes the weakness, it doesn’t show whether an attacker gained access before the fix was applied.

So, organizations should therefore avoid treating a successful update as proof that no incident occurred. Apply the fix, then check whether your systems were compromised before it was in place.

If you’re thinking about how your cyber insurance could respond, you should contact you insurance broker about the scope of coverage and any potential claims notification requirements. We’d recommend you identify every affected system, apply and verify the fix, investigate possible compromise and make sure critical suppliers have done the same.

How could PHP2Shell affect your organization through third-party suppliers?

PHP may sit within your websites, portals, internal applications, commercial software and third-party services. That means you could be exposed through your own systems, your suppliers, or impacts on your customers and partners.

You may also share the same underlying technology weakness with organizations you have no commercial relationship with.

That means you need to look beyond your own systems, checking whether critical suppliers use affected technology, what action they’ve taken and whether an incident affecting them could disrupt your business.

How could the PHP2Shell vulnerability affect cyber insurance coverage

The incident presents two potential loss scenarios: (1) where organizations suffer financial loss arising from either a precautionary shutdown of the insured's or a third-parties network, or (2) from an actual or suspected compromise of those networks.

A precautionary shutdown would not ordinarily trigger cover in the absence of an actual or suspected cyber incident. However, an actual or suspected compromise of the insured's network or a third-party service provider's network, including any voluntary shutdown to contain or mitigate the incident, would ordinarily be sufficient to trigger cover under a cyber policy, subject to its terms and conditions.

A PHP2Shell security intrusion could lead to data breaches, ransomware or cyber extortion, business interruption, and third-party claims. A typical cyber policy would generally respond to financial loss arising from some or all of these events.

What immediate actions should risk managers take to address PHP2Shell exposures?

Identify your exposure. Map PHP across your public-facing and internal systems, hosted services, commercial products and supplier-operated services. Prioritize anything accessible from the internet.

Apply the fix or isolate affected systems. Prioritize unsupported versions. If you can’t apply an update or provider fix immediately, isolate the service until you can verify the fix.

Check for earlier compromise. Look for evidence of unauthorized access before you applied the fix. If you find signs of compromise, activate your incident response procedures and check your cyber insurance notification requirements.

Challenge critical suppliers. Ask whether PHP2Shell affected them, when they applied the fix and whether they found evidence of earlier compromise.

Review your resilience and insurance response. Confirm you can isolate affected services and access backups. Assess how an interruption could affect your business and how your insurance may respond to compromise, supplier disruption, shutdown and response costs.