Insurers are waiting to see if claims emerge after organisations shut down websites this week due to a flaw in the PHP programming language that runs 70% of the internet.

The Australian Cyber Security Centre issued an alert today saying patches were being released to address two critical vulnerabilities in the PHP software.

Organisations around the world took down websites, including many government pages.

Marsh Risk head of cyber for the Pacific Brylee Jaghbir says insurers may receive business interruption claims, depending on how much insureds rely on their websites for revenue.

A cybersecurity expert in California discovered the PHP flaw using AI, prompting warnings that while AI can identify issues, organisations are also at risk from criminals using it to exploit weaknesses at a speed and scale not previously available.

Ms Jaghbir says organisations must reinforce proven security fundamentals such as strong access controls, threat detection and user awareness training – and investment in AI-enabled security capabilities is critical.

“Increasingly, security teams must work alongside AI and move from manual execution towards agility, speed, scale and oversight, including advanced detection.”

Temporary outages or delays with websites can be expected as the security patches are applied, according to Professor Rashina Hoda from Monash University’s Department of Software Systems and Cybersecurity.

“The vulnerability identified in the language itself means all websites and web apps that leverage it are now exposed, sending the world into an emergency ‘patch frenzy’.”

She says major banks and companies mostly do not rely on PHP for sensitive transactions, but businesses that use platforms such as WordPress are particularly vulnerable.

“We also need to watch out for a possible surge in scams and phishing attacks ... that pretend to be securing our information in the wake of this incident,” Professor Hoda said.