# Cloudflare: what they say

Cloudflare: WAF rules live 9 hours early; saw attack traffic; the claims this site attributes to them and their sources.

Party

# Cloudflare

WAF rules live 9 hours early; saw attack traffic

## Claims this site attributes to this party

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| PHP is used by almost 70% of websitesNone of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems. | Cloudflare; OpenAI ('an estimated 70%'); Wiz body text | reported | 3/3 | [Cloudflare](../../sources/cloudflare-blog-php2shell-waf/index.html) [OpenAI on X](../../sources/x-openai-php2shell/index.html) [Wiz](../../sources/wiz-blog-php2shell/index.html) |
| Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloadsPrimary party, no volumes. | Cloudflare | reported | 1/1 | [Cloudflare](../../sources/cloudflare-blog-php2shell-waf/index.html) |
| Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTCPrimary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | 1/1 | [Matthew Prince , Cloudflare CEO on](../../sources/x-eastdakota-php2shell-stats/index.html) |

## Its sources in the vault
- [Cloudflare deploys protections against php2shell vulnerability](../../sources/cloudflare-blog-php2shell-waf/index.html) Cloudflare

[Every party →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/actors/cloudflare/index.html