More security patches mean more downtime for critical systems, threatening cash flow and schedules.
The total cost of worldwide mitigation for two flaws in the PHP: Hypertext Preprocessor (PHP) scripting language is still being calculated.
The open-source language powers popular website content management systems (CMSs) like WordPress, Joomla, and Drupal, and an estimated 70% of websites on the internet had to shut down to apply a software patch released by the PHP Foundation on October 21.
Whenever a company shuts down a critical business system, it can disrupt the entire cash-conversion cycle. Invoices may not be issued, incoming payments may not match customer accounts, and reconciliation backlogs can build up, said Arpit Jain, a graduate student in the System Design and Management program at the Massachusetts Institute of Technology and part of Cybersecurity at MIT Sloan, or CMAS.
“Outgoing payments may be delayed, potentially creating supplier disputes or contractual penalties,” he added. “Meanwhile, cash forecasts become less reliable. Even a company that remains fundamentally solvent may need additional short-term liquidity or a credit facility to bridge the disruption.”
Whether cybersecurity insurance policies cover these precautionary shutdowns depends on the underwriter.
“What is most important to consider is the ability to differentiate via a scenario-based analysis: shutting down merely to install a routine security patch is generally not covered,” said Ranjan Pal, a research scientist at MIT’s CMAS. “Shutting down because of a documented, imminent threat originating from an affected supplier may qualify under specially worded coverage, even before the threat causes an incident at the insured company.”
AI Speeds Security Cycle
The rise of artificial intelligence (AI) and agentic AI has accelerated reporting of such issues to the Common Vulnerabilities and Exposures (CVE) system, which identifies and catalogs publicly disclosed cybersecurity vulnerabilities.
The surge in submissions has required the National Institute of Standards and Technology to adopt a risk-based triage model rather than analyze every CVE submitted to the National Vulnerability Database it maintains.
Since the CVE system launched in 1999, it has issued approximately 350,000 notices, estimated Jain. “This year, we are expecting 100,000 CVEs by the end of the year.”
Software giant Oracle issued a Critical Patch Update in October that identified 1,209 unique CVEs, 95 of which it identified as critical severity flaws, reported Security Week.
“On top of that, companies don’t even have the incentives to find these vulnerabilities often because their motto is profit first, which means product first,” said Pal. “With the advent of AI, the vulnerability-finding space will ramp up. So you can find more vulnerabilities using agentic AI or AI in general.”
Many software vendors have either scaled back their bug bounty programs dramatically or eliminated them altogether.
“All of the open-source maintenance are absolutely slammed because they’re getting so many vulnerability reports that many of them are legitimate,” said Jain. “Many of them are just newbies trying to claim that they found something, so they’re getting really slammed. Even GitHub, which used to issue CVEs in five days, now they’re taking two months.”
Although the economic incentive for programmers to report vulnerabilities may be lower, Pal said the increase in vulnerability reports is a positive thing for businesses.
“This will actually improve the fixing thing, because people will get more diligent in fixing stuff because they realize that the rate at which things are coming up is so fast. So that is one good thing, but the number of vulnerabilities reported will also be greater.”
Rob Daly covers the economy and fintech. He can be reached at rdaly@gfmag.com
