Precautionary outages and policy triggers
Precautionary shutdowns rather than confirmed cyber breaches are driving early losses linked to two critical vulnerabilities in the PHP scripting language, according to a report from Marsh Re. The reinsurance broker estimates that PHP runs 77% of websites and expects business interruption to be the primary loss driver, particularly for online retailers reliant on web access. Recovery depends heavily on policy wordings, triggers, waiting periods, sublimits and how insurers treat voluntary shutdowns. Dutch government services, Finland's state IT center and a Danish municipal IT provider temporarily restricted access or went offline following the emergency patches released on October 21.
Exploitation evidence and broker guidance
Evidence of active exploitation has grown since the report's publication, with the US Cybersecurity and Infrastructure Security Agency adding both flaws to its Known Exploited Vulnerabilities catalog. Industry experts advise businesses and brokers to verify how cyber policies handle voluntary shutdowns before claims arise, noting that small and mid-sized enterprises may face longer remediation tails than better-resourced firms.