PHP2Shell: Between the Patch and the Policy

On October 21, PHP released emergency fixes for two flaws, both rated 9.2, that let an outsider take control of a server without a password. UKON sits between the agencies that place cyber coverage and the MSPs that secure the technology underneath it. Since the fixes landed, here are the five questions we hear most, and how we're answering them.

THOUGHT LEADERSHIP

10/22/20264 min read

Carriers have published strong technical guidance on PHP2Shell, and policyholders running exposed PHP are already receiving alerts. Coalition's security alert is the place to start for patching detail.

UKON sits between the agencies that place cyber coverage and the MSPs that secure the technology underneath it. Since the fixes landed, our team has been fielding the questions that follow a carrier alert. Here are the five we hear most, and how we're answering them.

“In the last decade, carriers have become much more adept at underwriting and monitoring cyber risk,” says Andy Runyan, one of UKON's Virtual Cyber Insurance Managers. “SMBs acknowledging zero day threats and patching vulnerabilities quickly are critical strategies to staying in the good graces of the modern day cyber market.”

Pax8's Cyber Insurance Readiness Guide, which features UKON, makes the same point: vulnerability management is among the areas North American insurers scrutinize most.

The short version

On October 21, PHP released emergency fixes for two flaws, both rated 9.2, that let an outsider take control of a server without a password.
PHP runs roughly 7 in 10 websites, plus many of the admin tools behind firewalls, backups, phone systems and databases.
Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older will not receive an official fix.

Request UKON's PHP Cyber Advisory

UKON is sending its PHP2Shell cyber advisory to current agency and MSP partners, and you can request a copy for your clients by clicking the button below.

Get My Advisory

2. “Is this carrier email a scam?”

It's a fair question, and insureds are asking it. Major security events reliably bring look-alike emails. The safe habit is to confirm any alert through a phone number or portal the business already knows, not through links or numbers in the message itself.

1. “Carriers already notified insureds. Should agencies send something too?”

Yes, and it should be short. Carrier alerts are technical, and insureds are hearing from carriers, CISA, vendors and the news at once. A note from their agent turns that into three things they can use: confirmation the carrier notice is real, the claims hotline, and one person to call with questions.

UKON's plain-language client advisory is built for that note.

3. “If we take systems offline, is the lost income covered?”

CISA advises taking PHP systems offline when they can't be patched right away (CISA). That decision can cost revenue, and whether a policy responds depends on its wording. Some cyber policies include voluntary shutdown coverage. Many business interruption provisions respond only after an actual security failure.

The best time to read that wording is before the shutdown, with the agent. A record of why systems went offline, who recommended it and how long they stayed down makes any later conversation with the carrier easier.

Five Questions We Keep Seeing Regarding PHP Security

4. "What if something already got in?"

The carrier's claims hotline comes first, before remediation changes the evidence. Many policies require prompt notice and the use of carrier-approved forensic and legal responders.

With PHP2Shell, that evidence is thin. According to CrowdStrike, a successful attack leaves application logs clean, and the only server-side trace is a single memory-limit error in the web server's error log (The Hacker News). Log retention is part of the response.

5. "If a client is hit through a system we manage, who carries the loss?"

This is the MSP question, and it outlasts the patch. The answer sits across three documents rarely written together: the MSA, the MSP's Tech E&O and cyber coverage, and the client's own policy. A dated record of what was patched, when and by whom is the first thing any of them will ask for.

“MSPs know their clients' technology better than anyone,” Runyan says, “but insurance asks a different set of questions about who is liable, what is covered and what the contract actually promises.”

Pax8 Voyager Alliance Rewards

Eligible U.S. Pax8 partners can get their own answer by selecting UKON in the Pax8 Voyager Alliance Rewards program.

Eligible U.S. Pax8 partners can now redeem 500 Rewards points for UKON’s MSP Risk Management Assessment and an exclusive Risk Terrain Report. For more information on the program, click the button below.

Pax8 Voyager Alliance Rewards

Bring both sides to the table

Agencies see the policy. MSPs see the technology. Weeks like this go better when they've already met. Our 2026 Cyber Resilience Field Guide lists five questions worth asking this Cybersecurity Awareness Month, and this week the most useful may be the last: have our technology and insurance advisers ever spoken to one another?

Request UKON's PHP Cyber Advisory. Current agency and MSP partners can get the plain-language client advisory from their vCIM or Cyber Practice Leader, or by submitting a request.

Know before you need to.

Sources:

This post is provided for educational purposes and does not constitute legal, cybersecurity or insurance advice. Coverage, including business interruption and voluntary shutdown, varies by policy and insurer. Consult qualified technology, legal and licensed insurance professionals about your specific situation.