FCA authorised · FRN 724952 0117 325 0027Quote & buy →
PHP2Shell and cyber insurance
In most cases, yes: hosting moves some technical tasks to your provider, but not your legal responsibility for your data or your business's own losses. The PHP2Shell flaws fixed on 21 October 2026 show where that line falls, and why a host's contract rarely pays for what a cyber policy is designed to cover.
Part of: PHP2Shell and cyber insurance
In short
A hosting provider runs servers for you and, on managed plans, often patches the operating system and PHP. It does not take on your legal duties. Under UK GDPR you are usually the controller of your customers' data and your host a processor, so you remain primarily responsible if data is breached. Hosting terms commonly cap the host's liability, exclude lost profits and make you responsible for your own site, plugins and content. A cyber policy is designed for that gap: incident response, restoration, business interruption, notification costs and claims from others, subject to its wording.
Last updated 22 October 2026.
Only for part of it. A host takes on technical tasks, not your legal position. The NCSC's shared responsibility model says a provider will almost always be responsible for the availability and physical protection of its servers, but the customer always keeps some duties: making sure the service meets its security needs, configuring it securely and deciding what data to store in it.
How far the split goes depends on the plan you buy:
So if your site is breached, the first losses land with your business. Whether you can recover any of them from the host depends on its contract, and those contracts are written to limit that.
Hosting terms vary, but most business and consumer-grade hosting agreements contain some version of the following. Read your own terms, because they decide what you could recover.
Apex's contract clause check can help you see what a contract asks of you on insurance and liability.
Usually you. If your website collects customer or enquiry data, your business decides why and how that data is processed, which makes you the UK GDPR controller. A host that stores the data on your behalf and acts on your instructions is usually a processor. The ICO's guidance on controllers and processors explains that the role depends on who decides the purposes and means of processing, so check it against your own set-up.
The ICO is clear about what that means for you:
Hosting does not transfer these duties. It adds a supplier you are expected to choose and oversee with care.
Very likely, if your site runs on PHP and the server has not been updated since 21 October 2026. On 21 October 2026 the PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which researchers call PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution. The php.net advisory says all PHP installations serving web requests are at risk and that updating is the only safe choice. The NCSC published an alert on 21 October 2026 telling UK organisations to prepare to update immediately.
It is a useful test of who does what:
As of 21 to 22 October 2026, several security firms reported exploitation attempts, but no confirmed public breach had been attributed to PHP2Shell at the time of writing. If your site is compromised, your downtime, clean-up and customer notification costs fall on you first, whoever was meant to patch. For the full picture, see PHP2Shell and cyber insurance: what to do.
A cyber policy is designed to pay for your own incident costs and for claims against you. The table shows the usual position. Every policy differs, and cover always depends on its wording, limits, excesses and conditions.
| Loss | Host contract usually | Cyber policy usually |
|---|---|---|
| Lost revenue while your site is down | Excluded as consequential loss; service credits at most | Business interruption cover may respond after a waiting period |
| Cleaning and rebuilding your site and data | Your responsibility; host backups may help if included | Data and system restoration costs commonly covered |
| IT forensics and incident response | Not provided for your own site or application | Commonly included, often through an incident response service |
| Legal advice and notifying the ICO and customers | Your duty as controller | Legal and notification costs commonly covered |
| Claims from customers whose data is exposed | Capped, and may not apply to your share of fault | Privacy liability commonly covered |
| Regulatory investigations and fines | Not covered | Defence costs commonly covered; fines only where insurable by law and the wording allows |
Cyber policies have exclusions and conditions of their own, and some set requirements about applying security updates. Read what cyber insurance does not cover and whether cyber insurance covers unpatched vulnerabilities. If something does go wrong, the first 72 hours matter for both the ICO and your insurer. For the wider picture, see the UK cyber insurance guide.
For a small or mid-sized business, cyber proposal forms usually focus on a handful of questions. Having the answers ready is the quickest way to a quote.
Certification such as Cyber Essentials can help show your controls. Answer accurately, and tell the insurer about any incident or known issue, because a new policy will not usually cover something you already knew about. The cyber proposal form walkthrough explains each question, and you can start on the cyber insurance quote page.
Apex is an independent UK insurance broker. We are not an IT security firm, and we do not patch, scan or fix servers. We can help with the insurance side:
Cover always depends on the insurer's acceptance and the policy wording.
Hosting moves some technical tasks to your provider, but not your legal responsibility for customer data or your own losses. Host contracts commonly cap liability and exclude lost profits. A cyber policy is designed to cover incident response, restoration, business interruption and claims, subject to its wording, so many hosted businesses still consider it.
Possibly, but often only in part. It depends on what the host agreed to do, whether it failed to do it, and the contract's caps and exclusions. Terms commonly exclude consequential losses such as lost revenue and make you responsible for your own site, plugins and data. Under UK GDPR you usually remain the controller.
On shared or managed hosting the host usually controls the PHP build, so it should install the fixed versions released on 21 October 2026. You may still need to choose a supported PHP version in your control panel. On a server you manage yourself, patching PHP is usually your responsibility or your developer's.
A cyber policy commonly covers losses from a cyber attack, including one exploiting a software vulnerability, subject to its terms. Some policies contain conditions about applying security updates, and a new policy will not usually cover an incident you already knew about. Check your wording, or ask a broker to review it.
Insurers usually ask for your turnover and activity, how many personal data records you hold, whether you take card payments, how you back up data, whether MFA is on for email and admin accounts, how quickly you apply security updates, and who manages your IT and website.
Start a cyber quote online in a few minutes, or ask a broker to check your current policy's patching and notification conditions. Or call 0117 325 0027.
Start a cyber quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
