Insurers face the first claims from the PHP flaws behind the Palo Alto hack, and the losses are shutdowns
Marsh Re says the first losses from the PHP2Shell flaws are precautionary shutdowns landing on cyber insurance books, and wording decides who gets paid. Palo Alto's stock ran 14% on the AI-bug spending thesis, then gave ground on Friday.
Vincent Jiang · 3 min read
The first bill for PHP2Shell has arrived, and the losses came from shutdowns, not breaches 1. Marsh Re, a reinsurance broker, says early losses from the October PHP flaws come from precautionary shutdowns: companies and governments switched services off while emergency patches went in, and now want their insurers to pay for the downtime 1.
Insurers decide who gets paid for going dark
PHP2Shell is two critical flaws in PHP, the server-side scripting language Marsh Re estimates runs 77% of websites 1. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker run code on a web server; emergency patches arrived October 21 11.
Governments went dark on purpose
The response itself created the loss: Dutch government services including the DigiD identity system, Finland's state IT center and a Danish municipal IT provider temporarily restricted access or went offline, and most were restored after remediation 1. CISA, the US cyber agency, told organizations that could not patch immediately to take PHP systems offline until they could 12.
Marsh Re rates the business-interruption risk medium to high, especially for online retailers that rely on web access 1. Who gets paid turns on wording, trigger, waiting periods and how a voluntary shutdown is treated. Cowbell, a cyber insurer, told policyholders through its Simon Hughes to check now how their policy treats a voluntary shutdown, rather than finding out at claim stage. Coalition, another cyber insurer, says its policy has no clause barring cover for clients who skipped the patch 1.
The breach was narrow; the price was fear
The intrusion itself is narrower than the headlines suggest. A suspected China-nexus actor, assisted by AI tools DeepSeek and Kimi, scanned about 19,000 internet-facing Palo Alto firewalls, filtered to 240 targets and rooted 25, two of them in a US government-affiliated environment 23. The chain with the Fragnesia Linux kernel bug ran from first connection to root webshell in under 15 minutes 2.
From 19,000 scanned firewalls, 25 were rooted
Data
| Value | |
|---|---|
| Firewalls scanned | 19,000 |
| Filtered targets | 240 |
| Rooted | 25 |
Palo Alto Networks−3.91% — Palo Alto Networks, down 3.91 percent today puts its exposed installed base at 0.02% 3. CyberCube, a cyber-catastrophe modeling firm, said through William Altman that this is not the 1-in-200-year event insurers fear 1.
The tension for investors is that the market already priced the fear. Palo Alto ran 14% in a week on the AI-bug spending thesis at a 96x forward multiple against a 57x five-year average 4, then fell 3.86% on Friday in the tech selloff 5.
The 96x multiple now meets its first measured cost
The era's first measured cost of an AI-found flaw turns out to be customers switching the product off. Insurers are ruling on those claims now, and the answer shapes renewals. Palo Alto reports fiscal first-quarter results in mid-to-late November, with next-generation security annual recurring revenue guided to $9.54-9.56 billion 4. What to watch: which carriers honor a voluntary shutdown claim, and whether annual recurring revenue clears the top of guidance.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
