FCA authorised · FRN 724952 0117 325 0027Quote & buy →
PHP2Shell and cyber insurance
If you maintain or host clients' PHP sites, your PHP2Shell liability depends mainly on what you promised to do, how carefully you did it, and your data processor duties. Technology PI and cyber insurance usually respond to different parts of that exposure, depending on the wording.
Part of: PHP2Shell and cyber insurance
In short
PHP2Shell (CVE-2026-109618 and CVE-2026-109619, fixed in PHP releases on 21 October 2026) affects every PHP site you look after. A client whose site is compromised may claim in contract if you promised to patch, for breach of the implied duty of reasonable care and skill, or under UK GDPR if you were its processor. Depending on the wording, technology PI usually responds to those client claims and cyber usually covers your own incident costs. A mass event raises notification and aggregation questions. Record patch status per client now, and check what your policies require you to notify.
Last updated 22 October 2026.
This page is for web design agencies, freelance developers, hosting resellers and managed service providers (MSPs) who build, maintain or host PHP websites for clients. For the general question of IT supplier liability after any client breach, see MSP liability when a client is breached. This page deals with one event.
On 21 October 2026 the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution. The php.net advisory says there are no complete mitigations and updating is the only safe choice. The NCSC alert of 21 October 2026 told UK organisations to identify every system running PHP and prepare to update immediately.
Three things make this different for suppliers:
As of 21 to 22 October 2026, several security firms reported exploitation attempts. No confirmed public breach had been attributed to PHP2Shell at the time of writing.
A client who suffers a compromise will usually look at three routes.
Your maintenance plan, SLA, hosting terms or statement of work may promise security updates, monitoring, backups or response times. If you promised to apply critical updates within a set time and did not, that is a straightforward breach of contract argument. If your contract covers WordPress core and plugins only, and the host runs PHP, the scope of what you agreed matters a great deal. Liability caps and exclusions in the same contract will shape what a client can recover; see limitation of liability clauses in IT contracts.
Under section 13 of the Supply of Goods and Services Act 1982, a business supplying a service under a relevant contract gives an implied term to carry out the service with reasonable care and skill. Section 12 excludes contracts covered by Chapter 4 of Part 1 of the Consumer Rights Act 2015, so in practice this is the rule for business-to-business work. A negligence claim may run alongside it. What is reasonable depends on the facts, but a critical, publicly fixed flaw with a national alert sets a clear benchmark.
Caps are not always the end of it. Under section 2(2) of the Unfair Contract Terms Act 1977, a term excluding or restricting liability for negligence, other than for death or personal injury, is effective only so far as it satisfies the requirement of reasonableness.
If you host or manage sites holding your clients' customer data, you are likely to be their processor. Article 28 UK GDPR requires the controller-processor contract to oblige you to take the security measures required by Article 32 and to help the controller meet its obligations under Articles 32 to 36. Under Article 33(2) you must tell the controller about a personal data breach without undue delay. Under Article 82(2) a processor is liable for damage where it has not complied with obligations directed at processors or acted outside the controller's lawful instructions. The ICO says a processor may also face fines and other penalties, and that a supplier which decides the purposes and means of processing becomes a controller for that processing.
These are illustrative examples, not predictions. Any claim depends on the contract, the facts and causation.
If the client has its own cyber insurance, its insurer may pay the client first and then pursue you to recover what it paid, through subrogation.
They respond to different things. Technology PI, also called errors and omissions, is mainly third-party cover: claims by clients that your professional service fell short. Cyber is mainly first-party cover for incidents on your own systems, usually with some third-party liability for data and network security. The table shows the usual position; it always depends on the wording.
| Situation | Technology PI usually | Cyber usually |
|---|---|---|
| Client sues for lost revenue after you failed to patch its site | Responds to the claim and defence costs, subject to exclusions | May respond if the wording includes network security liability |
| Your own hosting servers or admin systems are compromised | Does not cover your own incident costs | Incident response, forensics and restoration commonly covered |
| Client data on servers you host is exposed | May respond, unless a cyber or data exclusion applies | Privacy liability and notification costs commonly covered |
| Liability you accepted in contract beyond the law | Commonly excluded or limited | Commonly excluded |
| Fixing your own work or giving credits | Often excluded | Not usually covered |
The gap to watch is a cyber exclusion in your PI policy with no matching cover on the cyber side. A combined tech PI and cyber policy can reduce that gap. Some cyber policies also have conditions about applying security updates, so check yours. Sector pages: web developers, digital agencies, hosting companies, MSP professional indemnity and MSP cyber insurance.
PI policies are usually written on a claims-made basis. If you become aware of circumstances that may give rise to a claim, many policies let or require you to notify them, so that a later claim attaches to the current policy. A mass event across many client sites can be one circumstance or many. Some insurers may accept a single notification listing affected clients; others may want each one identified. Check what your policy says and see cyber and PI notification obligations.
Whether several client claims count as one claim depends on the aggregation clause:
Whether one vulnerability counts as a single cause, or your separate failures to patch each site count as separate acts, turns on the wording and the facts. Nobody can say for certain in advance. Cyber policies use their own event and excess definitions.
| Action | Why it matters |
|---|---|
| Record patch status for every client: PHP version or build, date updated, and who controls PHP (you, the host or the client) | Dated evidence of reasonable care, and a list ready if you need to notify |
| Write to clients: what you have done, what sits outside your scope, and what they or their host need to do | Clarity on scope in writing; avoid admitting liability or promising compensation before speaking to your insurer |
| Check contracts: maintenance and SLA promises, data processing terms, liability caps and consequential loss exclusions | Shows what you agreed to do and what you may be liable for |
| Check your PI and cyber notification conditions and notify circumstances where the policy requires it | Late notification can put cover at risk |
| If a client site is compromised, tell the client without undue delay and follow your cyber policy's incident process | Processor duty under Article 33(2); the client may have 72 hours to report to the ICO |
Clients who ask what this means for them can be pointed to PHP2Shell and cyber insurance: what to do and do I need cyber insurance if my website is hosted.
Apex is an independent UK broker, not an IT security firm. We do not patch or scan systems. We can:
Cover always depends on the insurer's acceptance and the policy wording.
It depends on what the agency agreed to do, whether it acted with reasonable care and skill, and whether it was the client's data processor. If the contract covered PHP updates and the fix was not applied in reasonable time, a claim is more likely. If the host controlled PHP, responsibility may sit elsewhere.
Technology PI usually responds to client claims that your service fell short, such as a failure to apply updates you were responsible for, subject to the wording. Some PI policies exclude cyber-related losses, and PI does not usually cover your own incident costs. Cyber insurance is designed for those.
If you look after client sites that were exposed, check your PI and cyber notification conditions. Many PI policies let or require you to notify circumstances that may lead to a claim, and late notification can affect cover. Speak to your broker before admitting liability to any client.
It depends on your policy's aggregation clause and the facts. Claims from many clients might be treated as one claim, with one excess and one limit, or as separate claims, each with its own excess and all eroding any aggregate limit. Nobody can say for certain in advance.
Usually whoever controls the server. On shared or managed hosting, the host normally controls the PHP build, while an agency maintains the CMS and plugins. On a VPS or dedicated server managed by the agency, PHP is usually the agency's job. Your contract should say, and if it does not, clarify it in writing.
Tell us how many client sites you build, host or maintain. A broker will review your current cover or arrange technology PI and cyber, and come back to you. Or call 0117 325 0027.
Start a cyber enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
