A PHP programming language flaw discovered by a cybersecurity expert using AI has highlighted supply chain implications and possible wider exposures, insurance experts say.

Willis Pacific cyber and technology industry leader Benjamin Di Marco says last week’s incident shows how software supply chain cyber risks are growing more significant amid increased use of generative AI in security.

“This is making it much easier to find vulnerabilities across open source and commercial software, and it’s now possible to identify and demonstrate the exploitability of vulnerabilities much more quickly,” he told insuranceNEWS.com.au.

Modern organisations run on software supply chains they have limited visibility of, often using software they do not manage themselves.

Many website owners took down sites after the PHP flaw was discovered, acting as a precaution until a patch was available and raising questions over insurance policy responses.

“The trigger for cover often requires that the insured organisation has sustained an actual or suspected cyber event before the voluntary shutdown occurs,” Mr Di Marco said.

“In this case, it’s not clear if organisations that took down their websites as a precaution would satisfy this trigger.”

Mr Di Marco says it is not yet clear how organisations can most effectively use AI in defences, nor how cybersecurity domains such as vulnerability management, threat detection, containment and incident response can most effectively work in the age of AI.

Crawford & Company say the distinction between precautionary action and a confirmed cyber incident will be important when assessing claims and determining policy triggers, and the PHP event has demonstrated the potential for wider ramifications.

“A vulnerability in widely used technology can quickly become a cross-sector, multijurisdictional event, highlighting the concentration of risk in shared digital infrastructure,” Crawford Global Technical Services cyber head Paul Handy said.

“The potential exposure is broad, but the ultimate insured loss remains uncertain.”

Crawford says a co-ordinated global response, uniting cyber and wider specialist expertise, is essential to supporting clients from initial notification through to recovery.

Technology-driven incidents can give rise to interconnected exposures spanning marine, major and complex loss, renewables, technology professional indemnity and other specialist disciplines, the claims manager says.