# Fact: No traffic matching the php2shell exploit patterns was seen during Imperva's pre

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoring Who says it, its status (reported), its sources, and its timeline from publication to this site.

Fact · exploitation · reported

# No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoring

**Who says it:** Imperva Threat Research · **Sources:** [Imperva Threat Research](../../sources/imperva-blog-php2shell/index.html)

A negative finding from a party that had the details under embargo.

## Fact-check

**A2** Reported●●○○○○ measures differently · State · verdict: **holds**

Imperva's own post carries it verbatim, including that it had the details before disclosure; one named party, a negative about its own customer traffic in an undated window.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [imperva-blog-php2shell](../../sources/imperva-blog-php2shell/index.html) | carries | *During this pre-disclosure monitoring period, Imperva observed no traffic matching the monitored PHP2Shell exploit patterns.* | 3da873bdb21219a6 |
| [imperva-blog-php2shell](../../sources/imperva-blog-php2shell/index.html) | carries | *The researchers shared vulnerability details confidentially with Imperva ahead of public disclosure, enabling Imperva to verify its protection and begin monitoring customer traffic* | 3da873bdb21219a6 |
| [x-eastdakota-php2shell-stats](../../sources/x-eastdakota-php2shell-stats/index.html) | absent | *In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.* | 4069805bcb164ff1 |

Open tickets: [Finding-75](../../factcheck/index.html#Finding-75).

Graded in Run-1, resting on captures up to 2026-10-22 11:18 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Imperva Threat Research publishes [PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva](../../sources/imperva-blog-php2shell/index.html)
- 2026-10-22 11:18 UTCSaved into the evidence vault: Imperva Threat Research
- 2026-10-22Enters this site as reported in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#imperva-none).

## Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · reported
```
No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoring
Who says it: Imperva Threat Research
Status: reported
Topic: exploitation
Sources: imperva-blog-php2shell
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/imperva-none/index.html