Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · reported
Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads
Primary party, no volumes.
Fact-check
A2 Reported●●○○○○ · Attribution · verdict: holds
Cloudflare's own post carries both halves nearly verbatim; one named party. Echoes (The Hacker News, SentinelOne) trace to the same post.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| cloudflare-blog-php2shell-waf | carries | the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. | 302408765abf45e3 |
| cloudflare-blog-php2shell-waf | carries | We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches | 302408765abf45e3 |
| thehackernews-php2shell-4days | carries | Cloudflare has observed attack traffic targeting its customers, with threat actors "mutating the attack payload to try to bypass our protections | c1cb63141287484c |
Open tickets: Finding-64.
Graded in Run-1, resting on captures up to 2026-10-22 08:12 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Cloudflare publishes Cloudflare deploys protections against php2shell vulnerability
- 2026-10-22 08:12 UTCSaved into the evidence vault: Cloudflare
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads Who says it: Cloudflare Status: reported Topic: exploitation Sources: cloudflare-blog-php2shell-waf