Cloudflare blocks php2shell PHP flaw with new WAF rules on all plans

Cloudflare has deployed web application firewall protections against two PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, known together as php2shell. Starting October 21 at 3:02 am UTC, customers on free and paid WAF plans were protected by default, according to the company.

The flaws, disclosed by Calif.io, Wiz, OpenAI and Quarkslab, affect all web servers running PHP 5.4 or later. Cloudflare says an attacker could use them to cause denial of service, run remote code, or expose data when an application processes specially crafted HTTP traffic.

Rules went live about 9 hours before disclosure

Cloudflare says it built the WAF protections from early October 2026 and deployed them roughly nine hours ahead of the public disclosure. The company also says the vulnerability leaked before its official release date and that it saw attack traffic aimed at its customers, with attackers changing payloads to try to slip past the rules.

Because request data alone doesn’t always separate an exploit from legitimate traffic, Cloudflare built what it calls full transaction detection. The new WAF capability combines signals from the request and the response in the same HTTP transaction, so response rules can block a matching origin response before it reaches the requester. The php2shell rules are the first managed detections released on it.

What the vulnerabilities do

PHP is used by almost 70% of websites, Cloudflare notes, and the flaws sit in the PHP runtime itself. They involve how PHP handles memory when something goes wrong during a request: if processing stops unexpectedly, for example on running out of memory, PHP may fail to clean up safely and later use data or memory that was never fully set up or was already released.

Large requests are one way to put memory under pressure, but Cloudflare says the problem goes beyond resource consumption. By manipulating the data PHP meets in that invalid memory, an attacker may crash a PHP process, expose sensitive information, or execute code of their choosing.

Cloudflare worked on the mitigations with the PHP foundation, OpenAI and Wiz, among others. It says its analysts are still watching attack activity and will update the rules if new techniques appear, with changes tracked in its changelog.

The protections are already active automatically on every plan with WAF deployed, including Free, so there is nothing to switch on. Cloudflare still advises customers to patch their PHP installations, since the WAF is meant as an extra layer of defense.

Related reading

Sources

• Cloudflare deploys protections against php2shell vulnerability — Cloudflare Blog