Cloudflare Shields All Users From Early PHP Exploits With Emergency WAF Rules Before Oct 21 Patch
Cloudflare detects early attacks on two critical PHP vulnerabilities and deploys temporary WAF rules for all customers while awaiting an official security update scheduled for October 21.
Key points
- Cloudflare observes early exploitation attempts against two critical PHP flaws with CVSS scores of 9.2.
- The company has deployed initial Web Application Firewall rules to block known exploit patterns for all users.
- PHP plans to release a security update on October 21, 2026, after details leaked prematurely.
Cloudflare reports detecting early exploitation attempts targeting two critical PHP vulnerabilities whose technical details surfaced before the scheduled security release. The company has deployed an initial set of Web Application Firewall rules to block known exploit patterns for all customers, including those on free plans.
These firewall rules serve as a temporary protective layer while administrators await the official PHP security update, which is currently scheduled for 14:00 UTC on October 21, 2026. Cloudflare states it is continuously updating these rules as new attack patterns emerge, but emphasizes that they do not replace the need for underlying code fixes.
View the original post on X
Context and Background
The PHP Foundation has assigned both vulnerabilities a CVSS v4.0 score of 9.2, rating them as critical. Public reports identify the flaws as CVE-2026-109618 and CVE-2026-109619. Researchers describe them as remote code execution vulnerabilities, which could allow attackers to run arbitrary code on vulnerable servers. However, the PHP team has not yet published full technical details, such as affected components or precise attack paths.
Cloudflare’s Chief Technology Officer, Dane Knecht, noted that the company is seeing early attacks and is updating mitigations as new vectors appear. He described the WAF protections as a stopgap measure, urging customers to patch their systems as soon as the PHP Foundation releases the update. The company has not shared evidence regarding the scale or success rate of these exploitation attempts.
Who Is Affected
The warning raises urgency for teams running PHP websites, including those built with content management systems or software that bundles its own PHP runtime. The PHP security team announced an earlier release date after the initial leak and indicated it could move the release forward again if more technical details become public or if evidence of active exploitation increases.
Administrators should not assume the initial WAF rules block every possible exploitation technique, as new PHP2Shell exploit patterns may evade rules written for known requests. The distinction between observed attack attempts and successful compromises remains unclear, as Cloudflare has not disclosed details on targeted organizations or successful breaches.
What should you do?
Organizations should identify every internet-facing system that runs PHP to assess their exposure. Administrators should monitor PHP’s official security notices and their operating-system or hosting provider’s update channels for further developments. Once fixed releases are available, teams should verify the affected versions and apply the correct update promptly to ensure complete protection.
What to do and how to stay safe: Cloudflare
- Identify all internet-facing systems running PHP, including those using bundled runtimes or content management systems.
- Monitor official PHP security notices and hosting provider channels for the release of the security update.
- Apply the official patch immediately upon release to address the underlying code vulnerabilities.
- Verify that Web Application Firewall rules are active and being updated to block emerging exploit patterns.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When is the PHP security update for these critical flaws scheduled?
The security update is scheduled for 14:00 UTC on October 21, 2026, though the PHP team may move the release forward if more details leak.
Are Cloudflare's WAF rules effective against all exploit attempts?
No, the rules are a stopgap measure that blocks known exploit patterns and are being updated as new vectors appear, but they cannot replace code fixes.
What are the CVE IDs for these vulnerabilities?
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated critical with a CVSS v4.0 score of 9.2.
