Cloudflare Launches PHP Capture the Flag Challenge on HackerOne
Cloudflare has launched a limited-time PHP Capture the Flag challenge integrated into its Bug Bounty program to test and strengthen its web application firewall defenses against serious vulnerabilities.
Radwan AbdulhadiEditor and technology writer
Background and Context
Following a demanding period for internet security that involved significant vulnerabilities and runtime disclosures, Cloudflare worked continuously to protect its customers and the broader web ecosystem. The events included a situation where eight eMudhra intermediate certificates were compromised, which created the potential for forged certificates to impersonate servers. Shortly afterward, security researchers and teams addressed critical flaws tied to php2shell, involving severe vulnerabilities in the PHP runtime utilized by a major portion of the web.
In response to these developments, Cloudflare deployed client updates alongside multiple mitigations, updated its web application firewall with new rules to block exploitation attempts, and rolled out a new feature known as full transaction detection. These capabilities were made broadly available across all plans, including free tiers, reinforcing the company's commitment to baseline web security.
Introducing the CTF Challenge
Because the rapid adoption of artificial intelligence allows attackers to discover new attack vectors with unprecedented speed and efficiency, collecting real-world data to test defense assumptions remains crucial. To address this need, the organization launched the Cloudflare PHP Capture the Flag challenge hosted through its Bug Bounty program. Security researchers are invited to inspect a deliberately vulnerable installation placed behind the company's web application firewall defenses.
The operational parameters of the challenge keep the scope straightforward by focusing directly on CVE-2026-109618 and CVE-2026-109619, which are the two underlying flaws associated with php2shell. The target environment runs stock PHP 8.5.11 equipped with standard PHP extensions, Apache 2 via mod_php, and an empty index.php file inside a sandboxed Cloudflare Container, guarded by default WAF rules. A file designated as /flag resides inside the sandbox environment, and the entire sandbox along with the flag file is reset every few minutes.
Mission Objectives and Rules
Participants accepting the mission are tasked with bypassing the web application firewall protections, exploiting the PHP sandbox, and recovering the contents of the /flag file using their own research tools. Detailed environment specifications, scope parameters, and the flag verification form are available directly on the challenge page. All testing must target the authorized challenge hostname endpoints using the POST method, while out-of-scope areas include direct infrastructure access, upstream PHP projects, and unrelated third-party systems.
To claim a bounty for an eligible bypass, participants must have a HackerOne account, agree to the bounty terms, demonstrate attacker-controlled code or command execution through an authorized POST request, and recover the flag contents. Successful recovery must be validated through the user interface promptly before a sandbox reset occurs, followed by submitting a private report containing the exploit chain and relevant metadata.
Submission Guidelines
Submissions must include comprehensive details such as the endpoint, complete payload, request sequence, headers, encoding, and body bytes. Researchers must also provide raw request or response captures or a readable proof of concept capable of reproducing the full chain, alongside an explanation of the WAF bypass and execution method. Furthermore, participants need to supply the attempt ID, successful verification results, UTC timestamps, and a clear description of what makes their method materially distinct.
Cloudflare notes that UI verification alone does not substitute for a HackerOne report or establish reporting priority. Standalone file disclosure without remote code execution, local-only exploits, rediscovery of known PHP vulnerabilities, or partial chains without full objective completion are ineligible for awards. Duplicate rules apply strictly, meaning only the first complete and reproducible report for a distinct method is considered for bounties.
Industry Implications
While response blocking and security layers help prevent exposed data from reaching unauthorized parties, the company emphasizes that mitigations do not replace the necessity of patching vulnerable software at the origin. Administrators running PHP environments are encouraged to monitor the latest PHP security advisories and apply relevant software updates promptly. The limited-time competition remains open until removed from the platform, and interested researchers can visit the initiative to participate.
Sources
- Cloudflare BlogIntroducing the Cloudflare PHP Capture the Flag challenge
Continue chronologically
Related entity coverage
Related stories
Cloudflare Deploys WAF Protections for php2shell Vulnerabilities
Cloudflare has automatically deployed default WAF rules to protect web applications against newly disclosed php2shell vulnerabilities in PHP.
CISA Confirms Active Exploitation of PHP2Shell Flaws
CISA adds critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog and orders federal agencies to patch systems quickly.
PHP2Shell Flaws Successfully Exploited in the Wild
Critical PHP2Shell remote code execution vulnerabilities are now successfully exploited in the wild following early disclosures and leaks.
Critical PHP Vulnerabilities Threaten Websites Worldwide
Security patches roll out for two critical PHP vulnerabilities rated 9.2, impacting millions of sites and prompting warnings from cybersecurity agencies.
