Cloudflare Deploys Default WAF Rules for php2shell PHP Vulnerabilities

Cloudflare deployed default web application firewall protections against two newly disclosed PHP vulnerabilities, known collectively as php2shell, before the public disclosure date. The security firm activated these rules on October 21, 2026, at 3:02 am UTC, approximately nine hours ahead of the official announcement by researchers.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were identified by a team including Calif.io, Wiz, OpenAI, and Quarkslab. Cloudflare worked with the PHP Foundation and other partners to mitigate the risk. The firm observed attack traffic targeting its customers before the official release date, noting that attackers were mutating payloads to bypass initial defenses.

Context and Background

Cloudflare’s protection strategy utilized a new capability called full transaction detection. This method combines signals from both the HTTP request and the server’s response within the same transaction. Standard request-based rules often lack sufficient context to distinguish exploits from legitimate traffic, but response data helps confirm whether an exploit succeeded while reducing false positives.

These php2shell protections represent the first managed detections released using this full transaction detection capability. The system can block a matching origin response before it reaches the requester. Cloudflare security analysts continue to monitor attack activity and update rules as new techniques or variations emerge in the hours and days following the disclosure.

Who Is Affected

The php2shell vulnerabilities affect all web servers running PHP version 5.4 or later. PHP powers nearly 70% of websites on the Internet, including widely used platforms such as WordPress and Magento. Because the flaws reside in the PHP runtime itself, they can allow attackers to execute malicious code, expose customer data, or disrupt services on vulnerable servers.

The technical root cause involves how PHP handles memory during error conditions. Normally, PHP allocates memory for request processing and releases it when work finishes. However, if processing stops unexpectedly due to issues like running out of memory, PHP may fail to clean up memory safely. This can lead to the use of uninitialized data or references to released memory.

Attackers can trigger these conditions by sending specially crafted HTTP requests. Large requests can put memory under pressure, but the core issue is the manipulation of invalid memory. This manipulation may crash the PHP process, expose sensitive information, or allow remote code execution. The two CVEs differ in timing: one occurs when PHP interrupts work before internal data is initialized, and the other happens when a fatal error leaves references to released memory.

What should you do?

Cloudflare advises customers to patch their PHP repositories even though WAF protections provide an additional layer of defense-in-depth mitigation. The protections are available and deployed automatically on all plans with WAF enabled, including free users. Organizations should track new rules in the changelog for updates as the situation evolves.

What to do and how to stay safe: Cloudflare

• Verify that your web application firewall is enabled and configured to use default managed rulesets.
• Check your server logs for unusual HTTP request volumes or failed requests that might indicate probing attempts.
• Plan to update PHP installations to patched versions as soon as vendors release them, regardless of WAF status.
• Monitor vendor changelogs and security advisories for updates on new attack techniques or rule modifications.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did Cloudflare deploy protections for php2shell?

Cloudflare deployed default WAF protections on October 21, 2026, at 3:02 am UTC, about nine hours before public disclosure.

Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

All web servers running PHP version 5.4 or later are affected by these vulnerabilities.

Is the Cloudflare WAF protection available to free users?

Yes, the protections are deployed automatically on all plans with WAF, including free users.