Cloudflare has deployed web application firewall (WAF) protections against two PHP vulnerabilities disclosed today by Calif.io, Wiz, OpenAI and Quarkslab. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named php2shell, the flaws affect every web server running PHP 5.4 or later. When an application processes specially crafted HTTP traffic, an attacker may achieve denial of service, remote code execution, or data exposure.
Cloudflare worked within a coordinated disclosure effort alongside the PHP Foundation, OpenAI and Wiz. Its WAF rules were developed and deployed starting in early October 2026, roughly nine hours ahead of public disclosure, and from October 21, 3:02 am UTC, all customers on the free or paid WAF were protected by default. Notably, the vulnerability leaked before its official release date, and Cloudflare reports it observed attack traffic targeting its customers during that window.
The concrete changes:
- Default WAF coverage was enabled for both free and paid plans, requiring no customer configuration.
- Multiple mitigations were deployed for all customers rather than a single rule signature.
- Rules were shipped about 9 hours before public disclosure as part of the coordinated release.
- Attackers were observed mutating payloads to evade protection; Cloudflare tracked match volume and cross-referenced it against rule logic to adapt defenses.
For developers, the practical takeaway is that php2shell has a very wide footprint: any stack running PHP 5.4 or newer falls in scope, which covers the vast majority of production PHP deployments. Default-on WAF protection reduces immediate exposure, but it is a mitigation layer, not a patch. Teams should still track the upstream PHP fixes for both CVEs, confirm their framework and dependency versions, and watch for follow-up rule changes as attackers continue probing for bypasses. The early leak also shows why vendor-side detection and payload mutation tracking matter: disclosure timelines can slip, and defenses may be tested in the wild before fixes ship.
Source: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/