When CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, the reaction was immediate. Vendor alerts went out, threat intelligence teams started monitoring for exploitation, hosting providers began rolling out patches, and headlines quickly focused on one very large number: nearly 70% of the web uses PHP.
I attended a cyber security insurance conference last week, and naturally, AI was on everyone’s mind. The room was buzzing with discussions focused on worst case scenarios. People were wrestling with foundational questions: What if an automated system goes wrong? Which policy form actually covers it? Is it already wrapped into standard coverage, or do we urgently need affirmative coverage in place?
Artificial intelligence is changing how organizations collect, process, analyze, and act on data. It is also forcing businesses to reconsider whether their existing privacy and security controls are prepared for systems that can operate with increasing speed, scale, and independence.
The central challenge is not simply whether an organization uses AI. The greater concern is whether the organization understands what its AI systems can access, what those systems are permitted to do, and whether their actual behavior matches documented policies.
That gap between policy and operational reality may become one of the most significant risk management issues of the decade.
Organizations have spent years developing privacy notices, access-control policies, data-retention standards, and incident response procedures. However, AI systems introduce new questions that many of those policies were not originally written to address.
