CyberCube Warns AI is Accelerating Software Flaw Discovery via PHP2Shell Vulnerabilities

Cyber risk analytics firm CyberCube has identified PHP2Shell as a critical systemic threat, warning that AI-driven discovery of legacy software flaws is creating new aggregation risks for the insurance industry. With PHP powering 70% of identified websites, the vulnerability presents a significant challenge for underwriters assessing portfolio-wide exposure to unpatchable or overlooked systems.

What was announced

PHP2Shell consists of two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, which allow attackers to gain control of web servers or extract sensitive data from memory without authentication. The threat is particularly pervasive because PHP is the underlying technology for approximately 70% of identifiable websites. Beyond standard web servers, the software is frequently embedded in third-party products that end-users cannot easily patch or may not even recognize as containing the flawed code.

CyberCube has activated its Cyber Aggregation Event Response Service (CAERS) to provide intelligence to clients as the situation develops. The firm’s Security Incident Report (SIR) notes that while an emergency security release was issued on 21 October, probes were detected four days prior to the fix. Since then, attack attempts have reached the millions. Although most currently circulating exploit code is non-functional and no break-ins are confirmed, the SIR warns that successful intrusions often leave no trace, potentially leading to claims surfacing weeks or months later.

The analysis identifies PHP as a significant single point of failure (SPoF), with over 600 technologies in CyberCube’s database tied to the software. Rather than a single catastrophic event, the firm views this as a long-tail risk that will gradually diminish as updates are applied. Clients are being directed to use the Portfolio Manager tool to stress-test their exposure against various theoretical catastrophe scenarios.

"PHP2Shell is one of the clearest signs yet that AI is making older, overlooked flaws easier to find. Code that sat flawed and untouched for more than a decade was turned into a working exploit with AI’s help. Most of the exploit code now circulating publicly doesn’t work, but the barrier to building one that does is falling fast."

William Altman, Director of Cyber Threat Intelligence Services, CyberCube

The companies involved

CyberCube is a specialist provider of cyber risk analytics designed specifically for the insurance and reinsurance markets. The company provides a suite of software-as-a-service (SaaS) tools that help carriers, brokers, and MGAs quantify cyber risk for underwriting, portfolio management, and capital modeling. By combining data science with multi-disciplinary expertise, the firm enables the industry to make more informed decisions regarding cyber accumulation and individual risk selection.

The company has significantly expanded its global footprint, particularly within the Asian market, through strategic partnerships with major regional players. This expansion reflects the growing demand for sophisticated cyber modeling in territories where digital transformation is accelerating. CyberCube’s platform is used by some of the world’s largest insurance institutions to navigate the complexities of the cyber threat landscape, including the emergence of AI-driven vulnerabilities and state-sponsored threats. Its role as an independent analytics provider has made it a central figure in the development of standardized frameworks for evaluating multi-line insurance risks and systemic single points of failure across the global economy.

What FF News has reported before

CyberCube has been a frequent subject of coverage at FF News, with 24 previous reports detailing its technological advancements and market expansion. Recently, the firm has focused on the intersection of artificial intelligence and insurance risk, having launched the CyberCube Unveils I2T2 Framework to Quantify AI-Driven Insurance Risk Across Multi-Line Coverages in September 2026.

The company’s growth in the Asia-Pacific region has also been a major theme, including its partnership with Blackpanda and CyberCube Partner to Deliver Regional Cyber Risk Analytics Across Asia and its collaboration to expand its Asian footprint with Sompo Japan Insurance Partnership. Additionally, CyberCube’s modeling capabilities were highlighted when the firm analyzed the CyberCube Models £3.3bn 'Putin Tax' Threat to UK Economy, demonstrating its ability to quantify large-scale geopolitical cyber risks.

What this means from an insurtech perspective

From an insurtech perspective, PHP2Shell represents a fundamental shift in how carriers must evaluate systemic risk. The use of AI to weaponize legacy code means that historical "security through obscurity" is no longer a viable defense for policyholders. This puts immediate pressure on underwriters to prioritize patching speed as a primary risk signal rather than a secondary hygiene factor. For reinsurers, the "long-tail" nature of these potential breaches creates a significant attribution challenge; if an intrusion occurs now but the claim surfaces months later, determining which policy period or event trigger applies becomes legally and financially complex. This announcement reinforces the need for real-time, data-driven portfolio monitoring over traditional annual risk assessments.