Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · exploitation · confirmed
Amazon and Cloudflare saw sites being probed for the flaw
Both companies have since said so themselves.
Fact-check
A5 Confirmed●●●●●○ · Attribution · verdict: holds
Woodward's remark is carried by the BBC, and both companies independently say it in their own captured posts: Amazon (scanning attempts, honeypot hits) and Cloudflare (attack traffic targeting customers). Two independent primary parties, each checked.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| bbc-live-ckgel5xp2xv9t | carries | Woodward says companies like Amazon and Cloudflare that monitor what is going on online saw the weakness "was being probed for". | c88b8c5f4c6bc07d |
| cloudflare-blog-php2shell-waf | carries | we observed attack traffic targeting our customers. | 302408765abf45e3 |
| aws-security-blog-madpot | carries | Our internal threat intelligence system automatically detected and restricted malicious scanning attempts targeting this vulnerability. | 94315ded6e1175f2 |
Open tickets: Contradiction-2, Finding-15, Finding-93.
Graded in Run-1, resting on captures up to 2026-10-22 11:17 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21Cloudflare publishes Cloudflare deploys protections against php2shell vulnerability
- 2026-10-21Amazon publishes Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Securi
- 2026-10-22 06:16 UTCBBC News publishes PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:12 UTCSaved into the evidence vault: Cloudflare
- 2026-10-22 11:17 UTCSaved into the evidence vault: Amazon
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
- 2026-10-22Status changes from reported to confirmed in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
Amazon and Cloudflare saw sites being probed for the flaw Who says it: Alan Woodward, via the BBC Status: reported Topic: exploitation Sources: bbc-live-ckgel5xp2xv9t, cloudflare-blog-php2shell-waf, thehackernews-php2shell-4days