Critical security vulnerabilities recently disclosed in PHP, a programming language widely used to run websites and web applications, have prompted organizations worldwide to respond quickly. While patches were released, the exposed flaws affected numerous websites and raised important legal questions about breach reporting obligations, security requirements, vendor responsibilities and insurance coverage that organizations must address.