Cloudflare rolls out automatic protection against php2shell flaw in PHP

Two Flaws in the Language Itself, Not in a Plugin

Today, October 21, 2026, security firms Calif.io, Wiz, OpenAI, and Quarkslab disclosed two vulnerabilities in the PHP runtime, catalogued as CVE-2026-109618 and CVE-2026-109619 and jointly nicknamed php2shell, according to Cloudflare's blog. The flaws affect every web server running PHP 5.4 or later versions.

That means practically any PHP installation in production today. An attacker who sends specially crafted HTTP traffic can cause denial of service, remote code execution, or data exposure, depending on how the application processes the request. Since PHP powers something close to 70% of websites on the internet and underpins platforms like WordPress and Magento, the potential blast radius is large.

How the Flaw Works in Practice

The problem lies in how PHP manages memory when something goes wrong in the middle of processing a request. Under normal conditions, PHP allocates memory for request data and frees that memory once the work is done. When processing is interrupted unexpectedly, for example due to running out of memory, PHP can't always safely clean up that memory.

The two CVEs exploit this oversight in different ways: one uses data that was never properly initialized, the other accesses memory that has already been freed. An attacker can force these conditions with large requests, but the problem goes beyond simply exhausting server resources: by manipulating the contents of that invalid memory, it's possible to crash the PHP process, leak sensitive information, or, in the worst case, execute arbitrary code.

The Race Against the Clock Before Disclosure

Cloudflare joined the coordinated disclosure effort alongside the PHP Foundation, OpenAI, and Wiz, among others, and began developing protections in its web application firewall (WAF) starting in early October 2026. The rules were deployed roughly 9 hours before the public disclosure, and starting at 3:02 UTC on October 21, every Cloudflare WAF customer, free or paid, became protected by default.

According to the company, the vulnerability leaked before the official disclosure date, and attack traffic targeting Cloudflare customers was already present during that period. Attackers tested payload variations to try to bypass the protections, and the team tracked this by cross-referencing detection volume with each rule's logic.

The New Feature Behind the Protection

Blocking php2shell with request-based rules alone wasn't enough: request data by itself often doesn't provide sufficient evidence to distinguish an exploit from legitimate traffic. To solve this, Cloudflare created full transaction detection, a new WAF capability that combines signals from both the request and the response within the same HTTP transaction.

With this feature, a rule can block the origin's response before it reaches the requester, if it identifies that the exploit succeeded on the server side. The php2shell protections are Cloudflare's first managed detection to use this capability, reducing false positives by looking at the full context of the transaction.

In summary, coverage was rolled out as follows:

• Free customers receive 7 rules in the Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba), enabled automatically, with no action needed.
• Professional, Business, and Enterprise plan customers receive 7 equivalent rules in the Cloudflare Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee), but should check whether the ruleset is in blocking mode.
• All plans, including the free tier, gained a high-confidence rule in the new Cloudflare Managed Response Firewall Default (ID afffe22785674c80a31875c848d2242a), which acts on the origin's response.

What to Do Now, According to Cloudflare Itself

Having the WAF enabled doesn't fix the root problem: since the flaw is in the PHP runtime itself, updating application code or a single plugin fixes nothing. Those who run PHP directly need to update the interpreter itself following the project's official advisory; those who use managed hosting need to push their provider to apply that update.

While the patch isn't out yet, Cloudflare's recommendation is to keep WAF protection active as an extra layer of defense, and to restrict unnecessary uploads and limit upload size to reduce the attack surface, without treating this as a substitute for the real fix. For those using Cloudflare, the path is to open Security > Security Analytics > Events in the dashboard and filter by the published rule IDs, to inspect what has already been blocked and adjust the ruleset's scope where it makes sense.

What Remains Unclear

Cloudflare has not published a CVSS score, nor detailed how many of its customers have already faced exploitation attempts, nor how patch adoption is progressing among hosting providers. The company also warns that rule descriptions "will be updated soon" and that the security analysis team will keep adjusting protections as new attack variations emerge in the coming days, with changes logged in the product's changelog.

For those who develop or maintain PHP infrastructure in Brazil, the practical takeaway is straightforward: having a WAF, whether from Cloudflare or another vendor, reduces the exposure window, but doesn't replace going after the PHP patch with your hosting provider or the production distribution in use. Since WordPress and Magento run on top of PHP, stores and sites built on these platforms are on the front line of this problem, even without any vulnerability of their own in the theme or installed plugin.