GoKawiilCloudflare rolls out WAF protections against critical PHP 'php2shell' flaws
Security researchers at Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, affecting all web servers running PHP 5.4 or later. Cloudflare says it deployed WAF protections for free and paid customers by October 21 at 3:02 am UTC, roughly nine hours before the public disclosure, after coordinating with the PHP Foundation, OpenAI and Wiz.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaws could allow remote code execution, denial of service and data exposure on a huge share of the web's PHP-based infrastructure, making early mitigation valuable even though Cloudflare says patching remains necessary. Cloudflare's account of attackers mutating payloads before public disclosure suggests the vulnerability details leaked early, intensifying pressure on vendors to respond quickly. The company's new 'full transaction detection' capability, which inspects both requests and origin responses, points to an evolving approach to catching exploits that simple request-based WAF rules might miss.
- Two new PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), affect all servers running PHP 5.4+.
- Cloudflare says it deployed WAF defenses about nine hours before public disclosure after observing active attack traffic.
- Cloudflare introduced 'full transaction detection,' a new WAF capability analyzing both requests and origin responses, debuting with these protections.
Source: blog.cloudflare.com, 2026-10-21
Published there as: “Cloudflare deploys protections against php2shell vulnerability”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.