Cloudflare reports millions of PHP2Shell attempts after disclosure

Cloudflare’s telemetry

Cloudflare published an account of its PHP2Shell response on 21 October. It says managed WAF protections went live at 03:02 UTC, roughly nine hours before public disclosure, and that it observed attack traffic against customers. The post also describes attackers changing payloads to try to get past the rules.

SecurityWeek subsequently reported figures attributed to Cloudflare CEO Matthew Prince: thousands of attempts in the ten hours before the announcement, tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and millions by Thursday.

Why attempts are not compromises

This is the clearest public evidence that exploitation is not theoretical. It is also a reminder that attempt counts are not victim counts. A blocked request is an attempt. A successful compromise is a different event, and the public reporting reviewed here does not establish a confirmed mass compromise.

Cloudflare’s own conclusion is the important operational sentence: patch even with WAF protection. A WAF rule can be bypassed by payload variation, and a request that does not match a rule reaches the origin. The rule set is a way to buy time while updating, not a substitute for the update.

What to do with a WAF

If you run a WAF in front of PHP, confirm that the relevant managed rules are actually deployed in blocking mode, not merely available. Then patch PHP and restart workers. Keep the WAF in place during the transition. Do not treat “no alerts” as evidence that the origin is clean, because the flaws execute below application logging and a successful request may return a normal status.