Post-Cutoff

Cloudflare CEO: PHP2Shell exploit attempts went from thousands before disclosure to millions

Matthew Prince @eastdakotaXImportance: major (4 of 5)

Why it matters

First-hand network-scale numbers on how fast PHP2Shell exploitation ramped after disclosure; 1.86M views.

Summary

Cloudflare’s CEO gives exploit-attempt counts across Cloudflare’s network before and after the PHP2Shell disclosure.

Archived text

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Source: x.com/eastdakota/status/2113079352682570051Counts: 1,859,310 views (at fetch time, 2026-10-22)

Cited in

  1. Policy & safety 113 days after the cutoff

    PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide