Cloudflare Deploys Protections Against php2shell Vulnerabilities

Key Takeaways

• Cloudflare deployed automated WAF protections for all free and paid customers starting October 21, 2026, against the php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

• The vulnerabilities affect all web servers running PHP 5.4 or later, potentially allowing denial of service, remote code execution, and data exposure.

• Cloudflare introduced full transaction detection, a new capability combining request and response signals within the same HTTP transaction to block threats and reduce false positives.

• Administrators must update the PHP software running their applications, as WAF protections serve as a defense-in-depth layer rather than a replacement for patching.

Overview of php2shell Vulnerabilities

On October 21, 2026, Calif.io, Wiz, OpenAI, and Quarkslab disclosed two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as php2shell. These flaws impact all web servers running PHP 5.4 or later, which underpins platforms like WordPress and Magento and nearly 70% of websites. When applications process specially crafted HTTP traffic, attackers can cause denial of service, execute remote code, or expose sensitive data.

The vulnerabilities stem from how PHP handles memory errors during HTTP request processing. Normally, PHP allocates and releases memory for request processing. However, if processing stops unexpectedly—such as from running out of memory—PHP may fail to safely clean up resources. The first vulnerability involves PHP using uninitialized internal data during cleanup after running out of memory. The second involves a fatal error leaving PHP with references to released memory, which a later request in the same process may improperly access.

Cloudflare WAF Mitigations and Full Transaction Detection

Cloudflare participated in a coordinated effort alongside the PHP Foundation, OpenAI, Wiz, and others to deploy mitigations before public disclosure. Cloudflare deployed WAF protections about 9 hours ahead of public disclosure, protecting customers by default starting October 21 at 3:02 am UTC. Because attackers mutated payloads to bypass request-based rules, Cloudflare developed a new capability called full transaction detection.

Full transaction detection combines signals from both the request and the response within the same HTTP transaction. This allows the WAF to inspect the origin's response to confirm if an exploit succeeded, reducing false positives and enabling the system to block matching origin responses before they reach the requester. The protections are automatically deployed across all plans, including Free users under the Cloudflare Managed Free Ruleset and paid users under the Cloudflare Managed Ruleset.

Additional Advisory and Remediation Steps

On October 23, the PHP project published an informational advisory regarding a related vulnerability, CVE-2026-115560, found in PHP's session upload progress feature. This affects fully patched PHP releases such as 8.5.12, though Cloudflare WAF customers are protected against known exploit attempts if their site uses the default upload progress field name.

Because these flaws reside within the PHP runtime, updating website code or plugins alone does not remediate the issue. Administrators must update their PHP software following the official PHP advisories. Cloudflare advises keeping WAF protections enabled as an additional defense-in-depth layer while applying vendor patches. Administrators can also review security analytics events and customize rule scopes as needed.