Cloudflare Deploys Automatic WAF Protections for PHP2Shell Vulnerabilities
Cloudflare has rolled out automatic Web Application Firewall rules and a new full transaction detection capability to shield applications from critical PHP2Shell vulnerabilities.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
New PHP Vulnerabilities Target Runtime Memory Handling
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as php2shell, were publicly disclosed by multiple security organizations. These flaws affect all web servers running PHP 5.4 or later and can allow attackers to execute remote code, cause denial of service, or expose sensitive data by sending specially crafted HTTP traffic.
Because the issues reside within the PHP runtime rather than userland code or plugins, updating platforms like WordPress or Magento alone will not secure an environment. The vulnerabilities stem from how PHP handles memory cleanup following unhandled errors or memory exhaustion conditions, which can leave lingering references or uninitialized data that malicious payloads can manipulate.
Cloudflare Deploys Full Transaction Detection
To defend against attacks observed prior to public disclosure, Cloudflare developed and deployed WAF protections across its network. Free and paid customers are covered by default without requiring manual configuration. The mitigations utilize a newly introduced capability called full transaction detection, which combines request and response signals within a single HTTP transaction to accurately distinguish actual exploits from legitimate traffic and reduce false positives.
Immediate Action and Patching Guidance
While Cloudflare’s WAF rules provide an active layer of defense-in-depth mitigation, administrators must apply the official PHP software updates provided by their vendor or maintainer. Restarting all active PHP workers, such as FPM pools or long-running worker processes, is necessary to clear stale states. Security teams should monitor logs for segmentation faults or unusual worker crashes and track rule updates via the official changelog.
Source
Official announcement or documentation
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
