# Fact: Amazon and Cloudflare saw sites being probed for the flaw

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Amazon and Cloudflare saw sites being probed for the flaw Who says it, its status (confirmed), its sources, and its timeline from publication to this site.

Fact · exploitation · confirmed

# Amazon and Cloudflare saw sites being probed for the flaw

**Who says it:** Alan Woodward, via the BBC; confirmed by both companies' own posts · **Sources:** [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html) [Cloudflare](../../sources/cloudflare-blog-php2shell-waf/index.html) [Amazon](../../sources/aws-security-blog-madpot/index.html)

Both companies have since said so themselves.

## Fact-check

**A5** Confirmed●●●●●○ · Attribution · verdict: **holds**

Woodward's remark is carried by the BBC, and both companies independently say it in their own captured posts: Amazon (scanning attempts, honeypot hits) and Cloudflare (attack traffic targeting customers). Two independent primary parties, each checked.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | carries | *Woodward says companies like Amazon and Cloudflare that monitor what is going on online saw the weakness "was being probed for".* | c88b8c5f4c6bc07d |
| [cloudflare-blog-php2shell-waf](../../sources/cloudflare-blog-php2shell-waf/index.html) | carries | *we observed attack traffic targeting our customers.* | 302408765abf45e3 |
| [aws-security-blog-madpot](../../sources/aws-security-blog-madpot/index.html) | carries | *Our internal threat intelligence system automatically detected and restricted malicious scanning attempts targeting this vulnerability.* | 94315ded6e1175f2 |

Open tickets: [Contradiction-2](../../factcheck/index.html#Contradiction-2), [Finding-15](../../factcheck/index.html#Finding-15), [Finding-93](../../factcheck/index.html#Finding-93).

Graded in Run-1, resting on captures up to 2026-10-22 11:17 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21Cloudflare publishes [Cloudflare deploys protections against php2shell vulnerability](../../sources/cloudflare-blog-php2shell-waf/index.html)
- 2026-10-21Amazon publishes [Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Securi](../../sources/aws-security-blog-madpot/index.html)
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22 08:12 UTCSaved into the evidence vault: Cloudflare
- 2026-10-22 11:17 UTCSaved into the evidence vault: Amazon
- 2026-10-22Enters this site as reported in v0.1.0 (reconstructed from git)
- 2026-10-22Status changes from reported to confirmed in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#probing).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · reported
```
Amazon and Cloudflare saw sites being probed for the flaw
Who says it: Alan Woodward, via the BBC
Status: reported
Topic: exploitation
Sources: bbc-live-ckgel5xp2xv9t, cloudflare-blog-php2shell-waf, thehackernews-php2shell-4days
```
v2 · site v0.2.0 · 22 October 2026 · confirmedAmazon and Cloudflare saw sites being probed for the flawWho says it: Alan Woodward, via the BBCBBC; confirmed by both companies' own postsStatus: reportedconfirmedTopic: exploitationSources: bbc-live-ckgel5xp2xv9t, cloudflare-blog-php2shell-waf, thehackernews-php2shell-4daysaws-security-blog-madpot


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/probing/index.html