A pair of vulnerabilities in the open-source PHP scripting language forced an estimated 70% of websites worldwide to apply an emergency patch released by the PHP Foundation on October 21. Because PHP underpins widely used content management systems such as WordPress, Joomla, and Drupal, the resulting shutdowns rippled beyond IT departments into finance and operations teams still tallying the costs.
Why a Routine Patch Can Freeze Cash Flow
When a business takes a critical system offline to apply a fix, the disruption can cascade through the entire cash-conversion cycle, according to Arpit Jain, a graduate student in MIT's System Design and Management program and a member of Cybersecurity at MIT Sloan (CAMS). Invoices may go unissued, incoming payments may fail to match customer accounts, and reconciliation backlogs can accumulate. Outgoing payments may also stall, raising the risk of supplier disputes or contractual penalties, even at companies that remain financially sound.
Whether cyber insurance offsets these costs is far from guaranteed. Ranjan Pal, a research scientist at MIT's CAMS, said coverage typically hinges on the specific scenario: shutting down purely to install a routine patch is generally not covered, while a shutdown prompted by a documented, imminent threat tied to an affected vendor may qualify under more specialized policy language, even before any actual breach occurs.
A Flood of Vulnerability Reports Strains Reviewers
The disruption comes as the volume of reported software flaws keeps climbing. The Common Vulnerabilities and Exposures (CVE) system, which catalogs publicly disclosed security flaws, has logged roughly 350,000 entries since its 1999 launch, Jain estimated, with around 100,000 new CVEs expected by the end of this year alone. The surge has pushed the National Institute of Standards and Technology to adopt a risk-based triage approach for its National Vulnerability Database rather than reviewing every submission in depth.
Oracle's October Critical Patch Update alone identified 1,209 unique CVEs, including 95 rated critical severity, according to Security Week. Jain noted that open-source maintainers are increasingly overwhelmed, with platforms like GitHub, once able to issue CVEs within five days, now taking roughly two months amid a mix of legitimate reports and inexperienced submitters.
AI's Double-Edged Role
Pal attributed part of the reporting surge to the growing use of artificial intelligence and agentic AI tools, which make it easier to discover flaws at scale. At the same time, many software vendors have scaled back or eliminated bug bounty programs, reducing financial incentives for researchers to report issues through official channels.
Despite the strain, Pal argued the trend could ultimately benefit businesses by pushing vendors toward faster, more disciplined patching as the pace of disclosures accelerates, even as the raw number of reported vulnerabilities continues to climb.