PHP2Shell Claims Haven’t Arrived. Coalition Says That’s The Calm Before The Storm.

Estimated reading time: 7 minutes

Attack attempts on PHP2Shell have run into the millions. Cyber insurance claims haven’t followed yet. Coalition’s chief underwriting officer says that gap is normal. It is also temporary, he says. WTW’s Glyn Thoms says the underwriting question reaches well past the patch.

PHP2Shell is a pair of critical flaws in PHP. The language runs roughly 70% of websites whose server-side language is known. The two bugs, CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a web server without logging in. PHP shipped fixes on Oct. 21.

Attackers moved first. Amazon saw exploit attempts four days before the patches, BleepingComputer reported. CISA added both flaws to its Known Exploited Vulnerabilities catalog on Oct. 26. Honeypots recorded remote code execution on an Apache server running PHP 8.4.26, it reported.

Claims have not arrived in volume. Tiago Henriques, Coalition’s chief underwriting officer, addressed that in a Nov. 2 blog post. The quiet has left some “to wonder whether our entire industry has overhyped how bad this is,” he writes. His answer is no. Coalition sells cyber insurance and Coalition Control, a risk management platform. It scans policyholders’ internet-facing systems.

Why Coalition Expects PHP2Shell Claims To Lag

Henriques separates two kinds of attack. Crashing a vulnerable server is easy. “Crashing takes an afternoon,” he writes. Coalition’s own scanner does it, in a controlled way, to find out who is vulnerable.

Taking control is harder. The attacker has to make the server run their instructions. That takes weeks or months, Henriques writes. ASLR is the obstacle. He compares it to delivering a package to an address that keeps changing. “The street gets renumbered,” he writes.

The work also doesn’t transfer. PHP runs in many versions, built by different vendors and set up in different ways. An exploit tuned for one combination fails on the next. Most vulnerable servers in Coalition’s scans run old PHP branches, scattered across dozens of patch levels. “There’s no single target that covers the fleet,” Henriques writes.

Other data points the same way. Only about a third of identifiable PHP instances run the branches PHP’s fixes cover. Moody’s cited that Bitsight figure on Oct. 22. CyberCube’s William Altman says “most of the exploit code now circulating publicly doesn’t work,” Insurance Edge reported.

The break-in also isn’t the claim, Henriques writes. The claim comes with the ransomware note or the data theft, weeks after the attacker gets in. “The claims curve always lags the exploit curve by weeks,” he writes.

A Long Tail, Not A Single Catastrophe

Ratings agencies and modelers expect the losses to stretch out. AM Best warned of “a longer tail as threat actors may wait,” Insurance Journal reported. Attackers may hold off for some time before they act, it said. The tail could also lengthen “as issues play out in court,” AM Best said. It expects losses to reach directors and officers cover as well.

CyberCube calls PHP2Shell “a long-tail risk that will shrink as fixes are installed,” the outlet reported. It does not expect a single catastrophe. Moody’s sees losses emerging across different victims and timeframes. Small businesses with thin security resources may face a longer tail of individual compromises, it wrote.

Lagging losses are a recurring problem for cyber insurers. CINI reported in June that data stolen now and decrypted years later could fall outside the policy in force.

What Could Shorten The Lag

Not everyone expects weeks. OffSec, a security training company, says researchers have already built PHP2Shell exploits that get past ASLR. It says Wiz researchers used AI to finish in a week what once took a top team months. OffSec has published its own proof-of-concept exploit and a free training lab.

The same bugs can leak memory, OffSec says, citing Wiz. That memory can hold passwords, session tokens, and API keys. A stolen credential doesn’t need a working web shell to become a claim later. Attackers are increasingly logging in rather than breaking in, Bitdefender told CINI last month.

There is also a third flaw. PHP disclosed CVE-2026-115560 on Oct. 23. It can affect fully patched servers with an unusual session setup. It has no fix yet.

WTW: The Underwriting Question Is Wider Than AI

Glyn Thoms leads cyber at WTW, the insurance broker and risk adviser. He shared his view with CINI on what PHP2Shell means for underwriting.

“AI is not necessarily creating new vulnerabilities, but it is accelerating the discovery, analysis and potential weaponisation of vulnerabilities that may have existed for years,” Thoms said. “This is a race between defenders applying an available fix and attackers turning public technical detail into repeatable exploitation.”

“The underwriting question is therefore wider than whether an organisation uses AI,” he said. Underwriters should ask whether a company can find vulnerabilities fast and patch them quickly, Thoms said. They should also ask whether it can investigate a possible intrusion. And they should ask how it manages suppliers running the same software.

That supplier exposure is wide. CyberCube’s database ties more than 600 technologies to PHP, Insurance Edge reported. Leroy Terrelonge, senior vice president for cyber credit risk at Moody’s Ratings, put a number on it, Insurance Journal reported. The share of Moody’s-rated organizations hit through a third party rose from 19% in 2020 to 39% in 2025.

Patch Timing Shapes The Claims

Speed is the gap insurers watch. The median Moody’s-rated company takes 87 days to fix half of its known exploited vulnerabilities, Terrelonge said. CyberCube’s Altman says patching speed becomes “a stronger underwriting signal.”

Some policies already tie cover to patch timing. Chubb’s Neglected Software Exploit Endorsement gives policyholders 45 days to patch a published flaw, CINI reported. After that, the policyholder carries more of the loss. Under wording like that, a 45-day clock from the Oct. 21 fixes runs out on Dec. 5.

End-of-life servers can’t be patched at all. Most of the vulnerable servers Coalition sees fall in that group, Henriques writes. They need an upgrade or a web application firewall in front of them. Coalition saw the number of servers behind a firewall jump in the first two days, he writes.

Coalition alerts policyholders whose systems look exposed. CINI looked at how it picks which flaws merit an alert. The volume of flaws keeps rising. Published vulnerabilities more than doubled in the first nine months of 2026, Moody’s wrote. Exploited flaws grew more slowly, Cisco Talos found.

Henriques ends on the window that remains. The lack of claims is “the calm before the storm, not proof that the storm isn’t coming,” he writes. “Patch now, while attackers are still doing the hard part.”

FAQ – PHP2Shell

What is PHP2Shell?

Two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a web server without logging in. PHP released fixes on Oct. 21.

Why haven’t PHP2Shell insurance claims arrived?

Coalition says crashing a server is easy but taking control takes weeks. The claim comes later still, with the ransomware or data theft that follows a break-in.

Is PHP2Shell a catastrophe for cyber insurers?

CyberCube calls it a long-tail risk that will shrink as fixes are installed, not a single catastrophe. AM Best expects a longer tail, partly as issues play out in court.

What should underwriters ask about PHP2Shell?

WTW’s Glyn Thoms says they should ask whether a company can find and patch flaws fast. They should also ask about investigating intrusions and suppliers running the same software.

What if a server runs an old PHP version?

End-of-life versions can’t be patched. Coalition says they need an upgrade or a web application firewall in front of them.

Can policy wording depend on patch timing?

Yes. Chubb’s Neglected Software Exploit Endorsement gives policyholders 45 days to patch a published flaw. After that, they carry more of the loss.

Related Cyber Insurance Posts

• AI Didn’t Create The UK’s Cyber Weaknesses. It Revealed Them, The NCSC Says.
• Three In Four Exposed n8n Servers Run A Release With A Critical Flaw(Opens in a new browser tab)
• Silent Push 6.0 Gives Cyber Underwriters Sharper Threat Intelligence(Opens in a new browser tab)
• Private Equity Cybersecurity Gap: Alarming Stats & What Firms Must Fix in 2025(Opens in a new browser tab)
• Cybersecurity Crisis: WTW 2025 Report Reveals Alarming Supply Chain Threats(Opens in a new browser tab)