Cloudflare says it has rolled out web application firewall protections for a newly disclosed set of PHP flaws, known as php2shell, after coordinating with security researchers and vendors ahead of public release. The company says the protections were deployed before disclosure, and that customers on its free and paid WAF tiers were protected by default as attack traffic began appearing.
Cloudflare moves quickly on php2shell
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed today by Calif.io, Wiz, OpenAI and Quarkslab. According to the source material, the issues affect all web servers running PHP 5.4 or later and may allow denial of service, remote code execution and data exposure when an application processes specially crafted HTTP traffic.
Cloudflare says it participated in a coordinated effort to deploy mitigations to protect the internet, working with the PHP Foundation, OpenAI, Wiz and others. The company developed and deployed WAF protections starting in early October 2026, about nine hours before public disclosure. Beginning at 3:02 am UTC on October 21, Cloudflare customers using the company’s free or paid WAF were protected by default against php2shell.
The company also says it observed attackers mutating payloads in attempts to bypass the protections, and that it tracked both the volume of matches and the rule logic to understand those attempts. That detail matters because it suggests the vulnerabilities were not only theoretical at disclosure time; Cloudflare says it had already seen attack traffic aimed at customers.
Why these PHP flaws matter
PHP remains one of the most widely used server-side languages on the web. Cloudflare says it is used by almost 70% of websites, and notes that the php2shell vulnerabilities affect the PHP runtime itself. That makes them especially important because the weaknesses are not limited to a single app or plugin. They can potentially affect a large number of sites and services, including platforms built on PHP such as WordPress and Magento.
In practical terms, the flaws could let an attacker crash a PHP process, expose sensitive data, or execute code on a vulnerable server. Cloudflare’s summary says the issue arises when PHP handles an error and then tries to use data that was not fully initialized or memory that had already been released. The exploitation path involves specially crafted HTTP requests that put pressure on memory and trigger unsafe behavior inside the runtime.
The company notes that large requests can be one way to stress the server, but the attack is not just about consuming resources. By manipulating invalid memory, an attacker may be able to affect the process in ways that go beyond a simple denial of service. That is what makes the combination of remote code execution and data exposure particularly concerning for hosting environments.
The two CVEs at a glance
- CVE-2026-109618: PHP runs out of memory and stops work before some internal data has been properly initialized. During cleanup of that request, PHP may then treat unfinished data as if it were valid.
- CVE-2026-109619: A fatal error interrupts a request, leaving PHP with references to memory released when the request ends. When the same PHP process handles a later request, it may follow those outdated references and access invalid memory, potentially exposing sensitive data.
Although the two flaws differ in the exact failure mode, both stem from the same general class of problem: unsafe memory handling during error conditions. Cloudflare says these are flaws in the PHP runtime itself, which means updating site code or a plugin alone does not fix them. Administrators need to update the PHP software running their applications, or ask a hosting provider to apply the security update if PHP is managed for them.
How Cloudflare built the protection
Cloudflare says protecting against php2shell required more than standard request-based rules. In some cases, request data alone does not provide enough context to tell the difference between a legitimate request and a successful exploit attempt. The origin server’s response can provide additional signals, which helps reduce false positives while improving confidence.
To do that, Cloudflare introduced what it calls full transaction detection, a new WAF capability that combines signals from both the request and the response in the same HTTP transaction. Response rules can then block a matching origin response before it reaches the requester. According to Cloudflare, the php2shell protections are the first managed detections released using this capability.
That approach is notable because it moves beyond the traditional model of inspecting requests in isolation. If the exploit outcome becomes visible only after the server responds, using both sides of the exchange can make protections more precise. Cloudflare says that precision is important when defenders are trying to stop an active exploit without accidentally disrupting normal traffic.
What Cloudflare customers should do now
Cloudflare says customers using its Managed Ruleset are protected by default, including Free users. The company also says the protections are available and deployed automatically on all plans with WAF enabled. For paid customers on Professional, Business or Enterprise plans, Cloudflare recommends reviewing the Managed Ruleset deployment to confirm it is in block mode.
At the same time, Cloudflare is clear that WAF protections are not a substitute for patching PHP. The company urges administrators to apply the vendor update as soon as possible and keep the WAF protections enabled as a layer of defense in depth. Cloudflare says its analysts will continue monitoring attack activity and update the rules if new techniques or variations appear in the hours and days ahead.
For administrators who want to investigate what the WAF is blocking, Cloudflare says they can review events in Security > Security Analytics > Events and filter by the rule IDs listed in its announcement. That view shows the matched request, the action taken and the path involved, and can indicate whether the event came from a managed or custom rule.
Rule sets Cloudflare says it has deployed
For Free customers, Cloudflare says new rules were released under the Cloudflare Managed Free Ruleset, with no action required to enable protection. For paid plans, the company says the protections were released as part of the Cloudflare Managed Ruleset. Cloudflare also says the new Managed Response Firewall Default includes a default block for high-confidence signatures.
- Free plans: Cloudflare Managed Free Ruleset, Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba
- Paid plans: Cloudflare Managed Ruleset, Ruleset ID efb7b8c949ac4650a09736fc376e9aee
- Managed Response Firewall Default: Default block for High confidence Signatures, rule ID afffe22785674c80a31875c848d2242a
The source material also lists several rule IDs associated with the protection, including multiple “Generic Rules – Anomalous Execution” entries for both free and paid deployments. Cloudflare says customers who need to tailor the protection can adjust the scope of the Managed Ruleset to parts of an application where the rules are relevant.
Why this disclosure is a reminder to patch
Even with mitigations in place, the underlying issue remains in PHP itself. Cloudflare says restricting unnecessary uploads and limiting upload sizes can reduce exposure, but those measures do not replace the fix. That is an important distinction for operators who may be tempted to rely on edge protections alone after seeing a WAF announcement.
The broader takeaway is that coordinated disclosure can still leave defenders with little time between leak, exploitation and patching. Cloudflare says the vulnerabilities were leaked before the official release date, and that it had already seen attack traffic targeting customers. In that environment, pre-deployed WAF protections can buy critical time, but only a software update resolves the root cause.
For sites and services built on PHP, the immediate tasks are straightforward: confirm the hosting environment’s PHP version, apply the vendor’s security update, and keep Cloudflare or similar protections enabled while patching work is completed. For organizations running WordPress, Magento or other PHP-based applications, the stakes are especially high because those platforms sit on top of the affected runtime.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: October 21, 2026 at 10:33 pm
0 views
