Cloudflare Deploys WAF Protections for php2shell Vulnerabilities
Cloudflare has rolled out automatic web application firewall protections to safeguard sites against newly disclosed PHP vulnerabilities tracked as php2shell.
Radwan AbdulhadiEditor and technology writer
Disclosure of php2shell Vulnerabilities
Calif.io, Wiz, OpenAI, and Quarkslab have publicly disclosed two critical vulnerabilities in PHP, collectively tracked as CVE-2026-109618 and CVE-2026-109619, and widely referred to as php2shell. These security flaws impact all web servers running PHP version 5.4 or later. When an application processes specially crafted HTTP traffic, the underlying vulnerabilities may allow malicious actors to cause a denial of service, achieve remote code execution, or expose sensitive data.
Because PHP is utilized by nearly 70% of all websites across the internet and underpins widely deployed platforms such as WordPress and Magento, these runtime flaws carry the potential to impact a massive number of internet-facing applications.
Cloudflare Deploys Pre-Disclosure Mitigations
Cloudflare participated in a coordinated security effort alongside organizations like the PHP Foundation, OpenAI, and Wiz. As part of this collaborative disclosure process, Cloudflare developed and deployed web application firewall rules approximately nine hours ahead of the public announcement.
Starting on October 21, 2026, at 3:02 am UTC, Cloudflare customers utilizing either free or paid WAF tiers were automatically protected against php2shell exploit attempts. The company observed active leak activity prior to the official release date, noting that attackers actively mutated their payloads in attempts to bypass early defensive filters.
Introduction of Full Transaction Detection
Mitigating php2shell effectively demanded advanced filtering mechanisms beyond standard request-based rules. Request data alone frequently fails to supply sufficient evidence to reliably distinguish a malicious exploit attempt from legitimate traffic. To solve this, the response from the origin server provides essential additional context.
To address this architectural challenge, Cloudflare engineered full transaction detection, a new WAF capability that jointly analyzes signals from both the incoming request and the outgoing response within the same HTTP transaction. This allows response rules to successfully intercept and block matching origin responses before they ever reach the requester, effectively marking the first managed ruleset released using this advanced architecture.
Understanding the PHP Runtime Flaws
The vulnerabilities stem from how the PHP runtime manages memory errors during HTTP request handling. Under normal operation, PHP allocates memory to process request data and safely releases it upon completion. If processing is interrupted unexpectedly—such as through a memory exhaustion event—PHP can fail to clean up memory securely.
The two CVE entries differ primarily in the exact timing of their unsafe memory access. In one scenario, interrupted workflows leave unfinished internal data that PHP incorrectly treats as valid during cleanup. In the second scenario, fatal errors leave behind references to released memory, which subsequent requests might follow to expose sensitive data or run arbitrary code.
Recommended Remediation for Administrators
Because these vulnerabilities reside directly within the core PHP runtime environment, merely updating website application source code, plugins, or themes will not remediate the risk. Site administrators must update the underlying PHP software packages on their servers, or coordinate with hosting providers to apply the necessary security releases.
Security analysts strongly advise keeping Cloudflare WAF protection layers enabled concurrently with applying vendor patches as a defense-in-depth measure. Administrators can also adjust their rule configurations or update scopes to tailor defenses to specific application environments.
Sources
- Cloudflare BlogCloudflare deploys protections against php2shell vulnerability
Continue chronologically
Related entity coverage
Related stories
How AI Tools Helped Uncover Years-Old PHP Vulnerabilities
Security researchers used frontier artificial intelligence tools to expose long-standing flaws in the PHP scripting language, triggering rapid attacks.
Hackers Had Four-Day Head Start on Epic PHP2Shell Flaw
Amazon reveals hackers probed the critical PHP2Shell security vulnerability four days before public disclosure, triggering a global patch rush.
Will AI expose the rickety infrastructure of the internet?
An analysis of recent critical PHP vulnerabilities and how the rise of artificial intelligence may expose foundational weaknesses in web infrastructure.
Patch the Planet Initiative Coordinates Global PHP Response
Discover how the Patch the Planet initiative and frontier AI models uncovered critical vulnerabilities in PHP, driving a coordinated global response.
