# Source: Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Insurance Business: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business

**Insurance Business** · [https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx](https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx) · published 2026-10-22T11:59:56Z (modified 15:52:31Z, per the page's metadata) · added by `curator@php.newsroom` · slug `insurance-business-au-asiapac-attacks-begin`

Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Patchstack "conf...

## What it says, as the collector read it

#### Critical global website flaw sparks alerts across Asia-Pac as attacks begin | Insurance Business

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/tech-press/insurance-business/au-asiapac-attacks-begin`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: Insurance Business. Language: en. URL: https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx

#### What the page says

_Curator's reading of the capture._

Insurance Business (Australia) on Asia-Pacific agency warnings. An update at 1pm AEDT on 22 October says security vendors report exploitation beyond honeypots "though official agencies have yet to confirm it": Hadrian sees PHP2Shell exploited at scale, mostly through PHP's session upload-progress path; Patchstack "has confirmed multiple active exploitation incidents"; Cloudflare reports early attacks; against that, Huntress had not observed exploitation across its partner systems. It also says watchTowr's decoy servers recorded attempts and "No breach at a real organisation had been confirmed by the time the fixes were released", that exploit code circulates and that the Dutch NCSC expects large-scale attacks. It adds the insurance angle: the memory-disclosure impact (Wiz) could make a data leak notifiable without any outage, and tells clients to get written confirmation of patching and to check unpatched servers for a break-in. No organisation is named as compromised.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Patchstack "confirmed multiple active exploitation incidents"; "no victim organisation has been named"

Supports: data/compromise.json on the site (/compromise/)

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T012042Z · HTTP 200 · https://www.insurancebusinessmag.com/au/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594446.aspx- `headers.json` d7c6037a3d486dcfea6be77442fd206f61bc6906e70e92270a8041eb3f5543cb 1,441 bytes
- `page.html` 98d4b6426324d21a0f86b027448e1edb42f7f14f078cb666b8c2fb7df882f03e 103,632 bytes
- `provenance.json` 6e01812fd9981745cf7bddb9cfe50b700144a4470cdc9291f482f5a82c1dde8f 1,838 bytes
- `rendered.html` 4017fbe931ba3e838695e7ab60fc4c3b0b9976750eb6b68b958bc939e4bac0d7 275,204 bytes
- `screenshot.jpg` e3b290e88f04e0036da577427acade1fa7f0aaee342ce10de8c8f2d2aa846d00 823,298 bytes
- `text.txt` 8d88bddde485e36f27c001a80e9ad0506055b64f3879347345be5ad336a10cad 9,469 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/insurance-business-au-asiapac-attacks-begin/index.html