"These vulnerabilities, like the PHP vulnerabilities that were disclosed the other day, had been in the wild for years," Cloudflare CEO Matthew Prince said on the company's third quarter earnings call — a blunt opening to a call that ranged from vulnerability forensics to a forecast that AI agents will reshape web traffic and cloud economics.
PHP2SHELL: pre-disclosure exploitation and Cloudflare's forensic sweep
Prince told investors that the recently disclosed PHP2SHELL vulnerability likely was exploited by "nation-state actors and criminals" before it became public. He said Cloudflare is "going back through our logs looking for any evidence that hackers or nation-state actors or others had been using them in the past" and that he expects the company will "find examples of that." The comment positioned Cloudflare as actively searching its telemetry for past abuse tied to vulnerabilities that, in Prince's words, "had been in the wild for years."
Agentic traffic as a commercial and operational problem
Prince warned that some Cloudflare customers view AI agents as "a bane to their business and want to keep them away." To illustrate the friction, he described a hypothetical agent that scours 1,000 restaurant websites to assemble menus — an agentic sweep that might benefit one restaurant but impose costs on the other 999. Web searches, he acknowledged, have always generated low-value hits, but the expected scale of agent activity changes the calculus: Cloudflare has previously predicted agentic traffic will be "one thousand times greater than clicks from humans," a ratio Prince returned to repeatedly on the call.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadContainers, hyperscalers, and the claim that containers are "cooked"
Prince allowed that containers represent "a significant improvement over bare metal or even virtual machines" and credited them for fueling hyperscale clouds and mobile apps. Yet he argued that container-based architectures "just can't keep up in a cost-effective way with the new agentic paradigms of today," declaring containers effectively "cooked." That critique was paired with a commercial pitch: serverless "Workers" are presented as Cloudflare's alternative to containerized deployments in an agent-heavy future.
Products, adoption, and Meta's role in driving agentic traffic
Cloudflare offers products intended to block agents, reduce the cost and traffic impacts of agentic activity, or enable organizations to monetize AI-generated traffic. Prince said demand for those products is "growing fast" and that since July 1st "approximately five percent" of the web had opted in to Cloudflare's content protection products. He also said Meta is already a Cloudflare customer and that "Zuck's new 'Muse' agents will benefit Cloudflare by creating more agentic traffic that third parties want to tame." Prince tied these market signals to financial results: year-on-year revenue growth of 39 percent and quarterly revenue of $782.5 million.
Market reaction and the security-as-opportunity thesis
Prince framed the current wave of disclosed vulnerabilities as painful but commercially useful for Cloudflare: the company, he said, is "among the first to receive quiet disclosure of new vulnerabilities" and remediates them before disclosure. He cautioned that "it may seem like the sky is falling with the number of new security vulnerabilities that have been reported over the last few weeks" and admitted "we're not" through the worst. Investors reacted positively to the narrative and results: after-hours trading sent Cloudflare shares up by around 15 percent, recovering earlier losses that followed a roughly four percent drop across major US indices.
What this means for website operators, Meta, and nation-state actors
- Website operators: some already consider agents "a bane to their business" and are opting into content protection — Cloudflare reports "approximately five percent" of the web has done so since July 1st.
- Meta: identified by Prince as an existing Cloudflare customer, and its "Muse" agents are expected to increase agentic traffic that other web actors may want to manage or monetize.
- Nation-state actors and criminals: Prince said these groups "likely exploited" PHP2SHELL before disclosure and that Cloudflare's forensic review aims to find examples of prior use.
Prince's earnings call stitched together security alarm, commercial opportunity, and architecture critique: vulnerabilities that allegedly circulated before disclosure, a forecast of agent traffic outstripping human clicks by three orders of magnitude, and the claim that containers cannot economically absorb that load. Cloudflare positions serverless Workers and new protection products as the remedy, and investors rewarded the narrative with a notable after-hours bounce. The persistent throughline of the call was explicit — rapid growth in agentic traffic and continued security churn are both sources of risk and demand. Whether serverless alternatives and content-protection products can absorb the agent-driven surge while containing cost pressure on websites and clouds is the practical question the company has put on the table.
Source: The Register — "AI agents are a ‘bane’ for some website operators, says Cloudflare"
