October 26, 2026
As organizations respond to PHP2Shell vulnerabilities, Marsh Re examines the potential implications for cyber losses, accumulation risk, and the (re)insurance industry.
Executive summary
PHP2Shell (CVE-2026-109618 & CVE-2026-109619) refers to two critical memory corruption vulnerabilities discovered in August and leaked in October within PHP’s core engine. These vulnerabilities may enable unauthenticated remote code execution. Emergency patches were released on October 21.
At the time of writing, multiple security vendors had reported scanning and attempted exploitation activity, but there was no confirmed evidence of widespread successful compromise. Several organizations made precautionary decisions to restrict public access during remediation.
For the (re)insurance market, the potential loss outcome will depend on several factors. Incidents to date have largely involved precautionary outages rather than confirmed breaches, raising questions about whether policy triggers are satisfied. Coverage terms, waiting periods, and business interruption extensions will influence recoverable losses. Continued exploitation could also increase the severity of losses, particularly if activity develops into confirmed compromise, ransomware, or prolonged business interruption.
PHP2Shell presents a credible accumulation scenario, especially where exposure is concentrated in unpatched, internet-facing environments and shared infrastructure. However, the availability of emergency patches and the effectiveness of remediation measures may help limit the scale and duration of potential losses.
Key takeaways
- Accumulation risk warrants attention. PHP2Shell creates a credible accumulation scenario across unpatched and internet-facing environments, particularly where systems access sensitive data, shared infrastructure, or critical services that require rapid response.
- AI is playing a growing role in vulnerability discovery. Frontier AI models contributed to the identification and validation of the PHP vulnerabilities, highlighting the technology’s potential to accelerate the discovery of and mitigation against widespread exploits in a defensive capacity.
- Rapid remediation can limit potential losses. Although the vulnerabilities are not malicious in origin, established cyber hygiene practices, including timely patching and appropriate remediation, will help limit the damage of an escalation of malicious activity toward lucrative targets.
- Loss severity remains uncertain. Potential losses will depend on whether activity remains limited to precautionary shutdowns and remediation or develops into confirmed compromise, ransomware, data loss, and extended business interruption. In such instances, policy wording, waiting periods, and sublimits will influence the severity of claims from economic losses.
- While too early to determine impact, widespread exposure does not necessarily translate into material industry losses. The prompt availability and rollout of a patch in this instance will help limit downtime duration and reduce the severity of claims to the industry.
Explore the full analysis
Download the Marsh Re Cyber team's perspectives for a deeper assessment of PHP2Shell, including potential cyber loss scenarios, comparisons with previous vulnerabilities, and implications for insurance and reinsurance.