Cloudflare deploys protections against php2shell vulnerability
- ID
- 37906
- Status
- summarized
- Published
- 21 Oct 2026, 9:56 PM
- Fetched
- 21 Oct 2026, 11:48 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 7.0
- Created
- 21 Oct 2026, 11:49 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Cloudflare says it deployed WAF rules for two PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619 (php2shell), affecting PHP 5.4+ and potentially enabling denial of service, remote code execution, and data exposure. Protections were live by default for Free and paid WAF customers from October 21 03:02 UTC, about nine hours before public disclosure, using a new full-transaction detection capability that combines request and response signals. Cloudflare still says customers must patch their PHP repos because the WAF is only defense-in-depth.
Why it matters
If you run PHP, WordPress, or Magento anywhere, check the PHP version and patch now; Cloudflare WAF may already block php2shell on Free and paid plans, but only for traffic routed through Cloudflare. The new response-based WAF capability is useful as a compensating control, but it does not remove the need to patch the origin.
Discussion angle
How should teams verify PHP versions across WordPress/Magento estates and decide when automatic WAF protection is enough versus when origin patching must happen immediately?