# Source: Matthew Prince 🌥 on X: "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X

Matthew Prince (@eastdakota), Cloudflare CEO: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · social · primary · captured

# Matthew Prince 🌥 on X: "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X

**Matthew Prince (@eastdakota), Cloudflare CEO** · [https://x.com/eastdakota/status/2113079352682570051](https://x.com/eastdakota/status/2113079352682570051) · published 2026-10-22T01:25Z · added by `claude-story-site` · slug `x-eastdakota-php2shell-stats`

Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.

## What it says, as the collector read it

#### Matthew Prince 🌥 on X: "Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions no… / X

Captured by claude-story-site. Status: captured. Attempt counts: thousands before announcement, tens of thousands in 45 minutes, hundreds of thousands in 2 hours, millions by 01:25 UTC 22 Oct. 1.4M views at capture.

- Displayed '1:25 · 22 Oct 2026' in a UTC browser. Verbatim: 'In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.'

- Attempts, not blocks and not compromises. No blocked count.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Exploit attempts across Cloudflare's network: thousands in the ten hours before announcement, tens of thousands within 45 minutes after, hundreds of thousands within two hours, millions by 22 October 01:25 UTCPrimary party. Attempts, not compromises; no blocked count; 1.4 million views at capture. | Matthew Prince, Cloudflare CEO, on X | reported | 1/1 | [Matthew Prince , Cloudflare CEO on](../../sources/x-eastdakota-php2shell-stats/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-22 01:25 UTC | Matthew Prince posts Cloudflare's attempt counts: thousands before, millions after. | stated |

### Numbers from this source

| Figure | Of | Status |
|---|---|---|
| millions | exploit attempts seen across Cloudflare's network by 22 October 01:25 UTC | reported |

### Exploitation signals from this source
- [2026-10-22 01:25 UTC](../../exploitation/index.html): Thousands of attempts in the ten hours before announcement; tens of thousands within 45 minutes after; hundreds of thousands within two hours; millions now.

## The bytes
capture 20261022T111808Z · HTTP 200 · https://x.com/eastdakota/status/2113079352682570051- `headers.json` d77dc66c0c59c96e2e54ddfecf08d3b1bd24635a9d74435e5e11a42df31beefb 9,023 bytes
- `page.html` 957516e4670ab0fa18a3dbfcc6a2a4fb7bf154370fd7b09506a876e6d327f357 143,568 bytes
- `provenance.json` 6ef963e6f636da1603f65de2817e02480ed92a2c4d5b330a151bc2d515c21277 1,249 bytes
- `rendered.html` 25a31a5f7554396a5640c88efcf0624e0eab811ea96a53cebc603eb9c55925ad 165,274 bytes
- `screenshot.png` 7a098d734f074f04d4c95973bd0f4463f3c18bd7aaf274912a6eea795095879c 216,866 bytes
- `text.txt` 4069805bcb164ff1a04dbf2f3900e36c0c61120ca2122452ba6372c46f1737b3 1,884 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/x-eastdakota-php2shell-stats/index.html