# Fact: Cloudflare observed attack traffic targeting its customers after the leak, with 

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · exploitation · reported

# Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads

**Who says it:** Cloudflare · **Sources:** [Cloudflare](../../sources/cloudflare-blog-php2shell-waf/index.html)

Primary party, no volumes.

## Fact-check

**A2** Reported●●○○○○ · Attribution · verdict: **holds**

Cloudflare's own post carries both halves nearly verbatim; one named party. Echoes (The Hacker News, SentinelOne) trace to the same post.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [cloudflare-blog-php2shell-waf](../../sources/cloudflare-blog-php2shell-waf/index.html) | carries | *the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers.* | 302408765abf45e3 |
| [cloudflare-blog-php2shell-waf](../../sources/cloudflare-blog-php2shell-waf/index.html) | carries | *We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches* | 302408765abf45e3 |
| [thehackernews-php2shell-4days](../../sources/thehackernews-php2shell-4days/index.html) | carries | *Cloudflare has observed attack traffic targeting its customers, with threat actors "mutating the attack payload to try to bypass our protections* | c1cb63141287484c |

Open tickets: [Finding-64](../../factcheck/index.html#Finding-64).

Graded in Run-1, resting on captures up to 2026-10-22 08:12 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Cloudflare publishes [Cloudflare deploys protections against php2shell vulnerability](../../sources/cloudflare-blog-php2shell-waf/index.html)
- 2026-10-22 08:12 UTCSaved into the evidence vault: Cloudflare
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#cloudflare-traffic).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads
Who says it: Cloudflare
Status: reported
Topic: exploitation
Sources: cloudflare-blog-php2shell-waf
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/cloudflare-traffic/index.html