Leroy Terrelonge, Senior Vice President, Cyber Credit Risk, Digital Economy Group at Moody's Ratings: "PHP2Shell illustrates how AI can reduce the expertise and effort needed to weaponize software vulnerabilities, as we have recently reported. This will put further pressure on organizations that already struggle to patch vulnerabilities in a timely manner. While AI can weaponize vulnerabilities in days, the median Moody's-rated company takes 87 days to remediate half of known exploited vulnerabilities on its networks.
The incident also highlights how the growing reliance on third-party platforms can create concentrations of cyber risk, allowing vulnerabilities to affect many organizations simultaneously. In a recent study, we found that out of Moody's-rated organizations that experienced a cyber incident, the share of organizations affected by a cyber incident via a third party more than doubled from 19% to 39% between 2020 and 2025."
Moody's Ratings has published cyber insurance research (attached) examining how advances in AI could enable attackers to identify and exploit vulnerabilities more quickly, increasing the potential for cyber aggregation events affecting multiple organizations simultaneously. The report discusses the recently disclosed PHP vulnerabilities as an example of how AI-assisted vulnerability discovery may affect the cyber risk and insurance landscape.
The research notes that PHP2Shell received a CVSS v4.0 severity score of 9.2 out of 10, while reports indicate exploitation activity began before public disclosure, with an apparent exploit attempt observed four days before patches were released.
Moody’s initial assessment is that exploitation appears fragmented across multiple threat actors, limiting the potential for a single, concentrated accumulation event affecting insured portfolios simultaneously.
The analysis also highlights the growing scale of vulnerability management challenges facing organizations. More than 72,800 CVEs were published between January and September 2026, up 106% from the same period in 2025, with nearly 15,000 vulnerabilities published in September alone.
|
.jpg)
(2).jpg)