Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business

Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page au/tech-press/insurance-business/au-asiapac-attacks-begin, snapshot 20261023T012042Z. Copied byte for byte; every file's sha256 is in captures/20261023T012042Z/provenance.json. Publisher: Insurance Business. Language: en. URL: https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx

What the page says

_Curator's reading of the capture._

Insurance Business (Australia) on Asia-Pacific agency warnings. An update at 1pm AEDT on 22 October says security vendors report exploitation beyond honeypots "though official agencies have yet to confirm it": Hadrian sees PHP2Shell exploited at scale, mostly through PHP's session upload-progress path; Patchstack "has confirmed multiple active exploitation incidents"; Cloudflare reports early attacks; against that, Huntress had not observed exploitation across its partner systems. It also says watchTowr's decoy servers recorded attempts and "No breach at a real organisation had been confirmed by the time the fixes were released", that exploit code circulates and that the Dutch NCSC expects large-scale attacks. It adds the insurance angle: the memory-disclosure impact (Wiz) could make a data leak notifiable without any outage, and tells clients to get written confirmation of patching and to check unpatched servers for a break-in. No organisation is named as compromised.

Why it is here

From the promotion queue (index/promote.json, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Patchstack "confirmed multiple active exploitation incidents"; "no victim organisation has been named"

Supports: data/compromise.json on the site (/compromise/)

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.