Cloudflare deploys WAF protections for php2shell PHP vulnerabilities

• Cloudflare deployed WAF protections for php2shell (CVE-2026-109618 and CVE-2026-109619) starting October 21, 2026, at 3:02 am UTC, approximately 9 hours ahead of public disclosure.
• The vulnerabilities affect all web servers running PHP 5.4 or later, allowing attackers to cause denial of service, remote code execution, and data exposure via specially crafted HTTP traffic.
• Cloudflare introduced full transaction detection, a new WAF capability that analyzes both request and response signals within the same HTTP transaction to reduce false positives and block malicious origin responses.
• Protections are automatically enabled for all customers with WAF, including Free users, via the Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba) and Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee).

Vulnerability Details

• CVE-2026-109618 occurs when PHP runs out of memory and uses uninitialized internal data during cleanup.
• CVE-2026-109619 occurs when a fatal error leaves PHP holding references to released memory, which may be accessed in subsequent requests.
• These flaws exist in the PHP runtime, so updating website code or plugins alone does not fix them; administrators must update the PHP software itself.

Mitigation and Monitoring

• Cloudflare observed attackers mutating payloads to bypass initial protections and is continuously updating rules based on attack traffic analysis.
• Customers are advised to patch PHP repositories while keeping WAF protections enabled as a defense-in-depth measure.
• Users on Professional, Business, or Enterprise plans should verify their Managed Ruleset is deployed in block mode to ensure full protection.