--- title: "Insurers face the first claims from the PHP flaws behind the Palo Alto hack, and the losses are shutdowns" description: "Marsh Re says the first losses from the PHP2Shell flaws are precautionary shutdowns landing on cyber insurance books, and wording decides who gets paid. Palo Alto's stock ran 14% on the AI-bug spending thesis, then gave ground on Friday." publisher: "The Inference" section: "Security" published: 2026-10-31T21:02:45.684Z modified: 2026-10-31T21:02:45.684Z canonical: https://theinference.org/article/insurers-face-the-first-claims-from-the-php-flaws-behind-the-palo-alto-hack-and-the-losses-are-shutdowns language: en keywords: "Cybersecurity, Insurance, Palo Alto Networks, Data Breach" --- # Insurers face the first claims from the PHP flaws behind the Palo Alto hack, and the losses are shutdowns > Marsh Re says the first losses from the PHP2Shell flaws are precautionary shutdowns landing on cyber insurance books, and wording decides who gets paid. Palo Alto's stock ran 14% on the AI-bug spending thesis, then gave ground on Friday. The first bill for PHP2Shell has arrived, and the losses came from shutdowns, not breaches [1]. Marsh Re, a reinsurance broker, [says early losses from the October PHP flaws come from precautionary shutdowns](https://www.insurancebusinessmag.com/ca/news/cyber/php2shell-shutdowns-test-cyber-policy-triggers-595652.aspx): companies and governments switched services off while emergency patches went in, and now want their insurers to pay for the downtime [1]. ## Insurers decide who gets paid for going dark PHP2Shell is [two critical flaws in PHP](https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch), the server-side scripting language Marsh Re estimates runs 77% of websites [1]. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker run code on a web server; [emergency patches arrived October 21](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html) [11]. ## Governments went dark on purpose The response itself created the loss: Dutch government services including the DigiD identity system, Finland's state IT center and a Danish municipal IT provider temporarily restricted access or went offline, and most were restored after remediation [1]. CISA, the US cyber agency, [told organizations that could not patch immediately to take PHP systems offline until they could](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) [12]. Marsh Re rates the business-interruption risk medium to high, especially for online retailers that rely on web access [1]. Who gets paid turns on wording, trigger, waiting periods and how a voluntary shutdown is treated. Cowbell, a cyber insurer, told policyholders through its Simon Hughes to check now how their policy treats a voluntary shutdown, rather than finding out at claim stage. Coalition, another cyber insurer, says its policy has no clause barring cover for clients who skipped the patch [1]. ## The breach was narrow; the price was fear The intrusion itself is narrower than the headlines suggest. A suspected China-nexus actor, assisted by AI tools [DeepSeek](https://theinference.org/markets/companies/deepseek) and Kimi, [scanned about 19,000 internet-facing Palo Alto firewalls, filtered to 240 targets and rooted 25](https://theinference.org/article/suspected-chinese-attackers-rooted-palo-alto-networks-firewalls-as-the-stock-ran-14-on-ai-fear), two of them in a US government-affiliated environment [2][3]. The chain with the Fragnesia Linux kernel bug ran from first connection to root webshell in under 15 minutes [2]. *Chart: **From 19,000 scanned firewalls, 25 were rooted** Bars showing the funnel from the Dream investigation: 19,000 internet-facing Palo Alto firewalls scanned, 240 filtered targets, 25 successfully rooted, with counts labeled so the smallest stage stays readable.* *Internet-facing Palo Alto firewalls scanned in October 2026 by the suspected China-nexus actor: 19,000 scanned, 240 filtered as targets, 25 rooted, about 0.02% of the exposed installed base. Sources: Infosecurity Magazine, SecurityWeek. [2][3]* [Palo Alto Networks](https://theinference.org/markets/companies/palo-alto-networks) puts its exposed installed base at 0.02% [3]. CyberCube, a cyber-catastrophe modeling firm, said through William Altman that this is not the 1-in-200-year event insurers fear [1]. The tension for investors is that the market already priced the fear. Palo Alto ran 14% in a week on the AI-bug spending thesis [at a 96x forward multiple against a 57x five-year average](https://www.tikr.com/blog/palo-alto-soars-14-in-a-week-as-ceo-warns-of-ais-nuclear-sort-of-bomb) [4], then fell 3.86% on Friday in the tech selloff [5]. ## The 96x multiple now meets its first measured cost The era's first measured cost of an AI-found flaw turns out to be customers switching the product off. Insurers are ruling on those claims now, and the answer shapes renewals. Palo Alto reports fiscal first-quarter results in mid-to-late November, with next-generation security annual recurring revenue guided to $9.54-9.56 billion [4]. What to watch: which carriers honor a voluntary shutdown claim, and whether annual recurring revenue clears the top of guidance. ## Takeaway The first PHP2Shell losses are precautionary shutdowns landing on cyber insurance books, and policy wording decides who gets paid; Palo Alto's 96x forward multiple now meets its first measured cost. ## Sources 1. [Insurance Business, PHP2Shell shutdowns test cyber policy triggers, 31 October 2026](https://www.insurancebusinessmag.com/ca/news/cyber/php2shell-shutdowns-test-cyber-policy-triggers-595652.aspx) 2. [Infosecurity Magazine, Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit, 30 October 2026](https://www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/) 3. [SecurityWeek, PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress, 30 October 2026](https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/) 4. [TIKR, Palo Alto Soars 14% in a Week as CEO Warns of AI's Nuclear Sort of Bomb, 29 October 2026](https://www.tikr.com/blog/palo-alto-soars-14-in-a-week-as-ceo-warns-of-ais-nuclear-sort-of-bomb) 5. [Barron's via Yahoo Finance, Cybersecurity Stocks Tumble in Tech Selloff, 30 October 2026](https://finance.yahoo.com/m/8d8f36ed-e408-3ef3-9ec8-79dc8adfd043/cybersecurity-stocks-tumble.html) 11. [The Hacker News, PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge, 21 October 2026](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html) 12. [CISA, Critical Vulnerabilities in PHP Require Immediate Patching, alert updated 26 October 2026](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) --- Insurers face the first claims from the PHP flaws behind the Palo Alto hack, and the losses are shutdowns — The Inference. Canonical: https://theinference.org/article/insurers-face-the-first-claims-from-the-php-flaws-behind-the-palo-alto-hack-and-the-losses-are-shutdowns