Cyber: Comments on That PHP Website Thing

“This week’s PHP alert is a useful reminder that an insurer’s exposure doesn’t stop at its own systems. Policyholder data moves through broker and MGA portals, claims TPAs and other partners, so the logical step now is to ask those partners directly whether they’re affected and what they’ve patched.”

This from Simon Hughes, Chief Commercial Officer at Cowbell:

“For most UK small businesses, the first question isn’t ‘have we patched PHP?’ It’s ‘do we use PHP?’ Many won’t know. It sits underneath the WordPress site, the online booking system and the customer portal a web agency built years ago. So today’s first call should be to whoever hosts your website: are we running PHP, has it been updated, and if not, when?

The NCSC has advised organisations that can’t patch to consider taking systems offline. That’s sound advice, but it has a commercial cost. Businesses that switch off as a precaution, and the brokers advising them, should check now how their cyber policy treats a voluntary shutdown and what waiting period applies, rather than finding out at claim stage.

Patching isn’t a ‘silver bullet’ either. These flaws can expose data quietly, so businesses should check for signs of compromise and change passwords on affected systems. A personal data breach may need reporting to the ICO within 72 hours.

AI helped find these flaws, and attackers have access to the same tools. The gap between a fix being published and being exploited is now measured in hours, not weeks. That’s why continuous monitoring of a business’s exposure matters more than a once-a-year questionnaire.”

Graham Ludlam, Partner – Speciality & Complex Risk Insurance at HF said:

“Most London Market cyber policies will only respond once a relevant event, such as a breach or cyber incident, has occurred. Identifying and patching a vulnerability is generally regarded as day-to-day IT expenditure and therefore would not typically be covered, although some products may provide tightly defined, sub-limited cover for remedial work.

“Some policies will also fund security improvements following an incident to help prevent a recurrence, but without an event triggering the policy’s main covers, those costs would ordinarily remain with the insured. Failure to address a known vulnerability on this scale could also create management liability exposures if it amounted to a breach of directors’ duties.

“From a reinsurance perspective, the systemic nature of a vulnerability like this is particularly significant: if it were exploited successfully across multiple organisations, it could create a substantial accumulation of cyber claims.”